./Ultimate.py --spec ../../sv-benchmarks/c/properties/unreach-call.prp --file ../../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_ppp.ko-entry_point_false-unreach-call.cil.out.c --full-output --architecture 64bit -------------------------------------------------------------------------------- Checking for ERROR reachability Using default analysis Version aa418289 Calling Ultimate with: java -Dosgi.configuration.area=/tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/data/config -Xmx12G -Xms1G -jar /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/plugins/org.eclipse.equinox.launcher_1.3.100.v20150511-1540.jar -data @noDefault -ultimatedata /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/data -tc /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/config/AutomizerReach.xml -i ../../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_ppp.ko-entry_point_false-unreach-call.cil.out.c -s /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/config/svcomp-Reach-64bit-Automizer_Default.epf --cacsl2boogietranslator.entry.function main --witnessprinter.witness.directory /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer --witnessprinter.witness.filename witness.graphml --witnessprinter.write.witness.besides.input.file false --witnessprinter.graph.data.specification CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) --witnessprinter.graph.data.producer Automizer --witnessprinter.graph.data.architecture 64bit --witnessprinter.graph.data.programhash 6186ef142a0a91a64444136f0ec69676cad8008d ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ Execution finished normally Writing output log to file Ultimate.log Writing human readable error path to file UltimateCounterExample.errorpath Result: FALSE --- Real Ultimate output --- This is Ultimate 0.1.23-aa41828 [2018-11-23 05:14:44,728 INFO L170 SettingsManager]: Resetting all preferences to default values... [2018-11-23 05:14:44,729 INFO L174 SettingsManager]: Resetting UltimateCore preferences to default values [2018-11-23 05:14:44,737 INFO L177 SettingsManager]: Ultimate Commandline Interface provides no preferences, ignoring... [2018-11-23 05:14:44,737 INFO L174 SettingsManager]: Resetting Boogie Preprocessor preferences to default values [2018-11-23 05:14:44,738 INFO L174 SettingsManager]: Resetting Boogie Procedure Inliner preferences to default values [2018-11-23 05:14:44,738 INFO L174 SettingsManager]: Resetting Abstract Interpretation preferences to default values [2018-11-23 05:14:44,739 INFO L174 SettingsManager]: Resetting LassoRanker preferences to default values [2018-11-23 05:14:44,741 INFO L174 SettingsManager]: Resetting Reaching Definitions preferences to default values [2018-11-23 05:14:44,741 INFO L174 SettingsManager]: Resetting SyntaxChecker preferences to default values [2018-11-23 05:14:44,742 INFO L177 SettingsManager]: Büchi Program Product provides no preferences, ignoring... [2018-11-23 05:14:44,742 INFO L174 SettingsManager]: Resetting LTL2Aut preferences to default values [2018-11-23 05:14:44,743 INFO L174 SettingsManager]: Resetting PEA to Boogie preferences to default values [2018-11-23 05:14:44,743 INFO L174 SettingsManager]: Resetting BlockEncodingV2 preferences to default values [2018-11-23 05:14:44,744 INFO L174 SettingsManager]: Resetting ChcToBoogie preferences to default values [2018-11-23 05:14:44,745 INFO L174 SettingsManager]: Resetting AutomataScriptInterpreter preferences to default values [2018-11-23 05:14:44,745 INFO L174 SettingsManager]: Resetting BuchiAutomizer preferences to default values [2018-11-23 05:14:44,746 INFO L174 SettingsManager]: Resetting CACSL2BoogieTranslator preferences to default values [2018-11-23 05:14:44,748 INFO L174 SettingsManager]: Resetting CodeCheck preferences to default values [2018-11-23 05:14:44,749 INFO L174 SettingsManager]: Resetting InvariantSynthesis preferences to default values [2018-11-23 05:14:44,750 INFO L174 SettingsManager]: Resetting RCFGBuilder preferences to default values [2018-11-23 05:14:44,750 INFO L174 SettingsManager]: Resetting TraceAbstraction preferences to default values [2018-11-23 05:14:44,752 INFO L177 SettingsManager]: TraceAbstractionConcurrent provides no preferences, ignoring... [2018-11-23 05:14:44,752 INFO L177 SettingsManager]: TraceAbstractionWithAFAs provides no preferences, ignoring... [2018-11-23 05:14:44,753 INFO L174 SettingsManager]: Resetting TreeAutomizer preferences to default values [2018-11-23 05:14:44,753 INFO L174 SettingsManager]: Resetting IcfgTransformer preferences to default values [2018-11-23 05:14:44,754 INFO L174 SettingsManager]: Resetting Boogie Printer preferences to default values [2018-11-23 05:14:44,755 INFO L174 SettingsManager]: Resetting ReqPrinter preferences to default values [2018-11-23 05:14:44,755 INFO L174 SettingsManager]: Resetting Witness Printer preferences to default values [2018-11-23 05:14:44,756 INFO L177 SettingsManager]: Boogie PL CUP Parser provides no preferences, ignoring... [2018-11-23 05:14:44,756 INFO L174 SettingsManager]: Resetting CDTParser preferences to default values [2018-11-23 05:14:44,757 INFO L177 SettingsManager]: AutomataScriptParser provides no preferences, ignoring... [2018-11-23 05:14:44,757 INFO L177 SettingsManager]: ReqParser provides no preferences, ignoring... [2018-11-23 05:14:44,757 INFO L174 SettingsManager]: Resetting SmtParser preferences to default values [2018-11-23 05:14:44,758 INFO L174 SettingsManager]: Resetting Witness Parser preferences to default values [2018-11-23 05:14:44,758 INFO L181 SettingsManager]: Finished resetting all preferences to default values... [2018-11-23 05:14:44,759 INFO L98 SettingsManager]: Beginning loading settings from /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/config/svcomp-Reach-64bit-Automizer_Default.epf [2018-11-23 05:14:44,768 INFO L110 SettingsManager]: Loading preferences was successful [2018-11-23 05:14:44,769 INFO L112 SettingsManager]: Preferences different from defaults after loading the file: [2018-11-23 05:14:44,769 INFO L131 SettingsManager]: Preferences of Boogie Procedure Inliner differ from their defaults: [2018-11-23 05:14:44,769 INFO L133 SettingsManager]: * ... calls to implemented procedures=ONLY_FOR_CONCURRENT_PROGRAMS [2018-11-23 05:14:44,770 INFO L131 SettingsManager]: Preferences of BlockEncodingV2 differ from their defaults: [2018-11-23 05:14:44,770 INFO L133 SettingsManager]: * Create parallel compositions if possible=false [2018-11-23 05:14:44,770 INFO L133 SettingsManager]: * Use SBE=true [2018-11-23 05:14:44,770 INFO L131 SettingsManager]: Preferences of CACSL2BoogieTranslator differ from their defaults: [2018-11-23 05:14:44,770 INFO L133 SettingsManager]: * Overapproximate operations on floating types=true [2018-11-23 05:14:44,771 INFO L133 SettingsManager]: * Check division by zero=IGNORE [2018-11-23 05:14:44,771 INFO L133 SettingsManager]: * Pointer to allocated memory at dereference=IGNORE [2018-11-23 05:14:44,771 INFO L133 SettingsManager]: * If two pointers are subtracted or compared they have the same base address=IGNORE [2018-11-23 05:14:44,771 INFO L133 SettingsManager]: * Check array bounds for arrays that are off heap=IGNORE [2018-11-23 05:14:44,771 INFO L133 SettingsManager]: * Check if freed pointer was valid=false [2018-11-23 05:14:44,771 INFO L133 SettingsManager]: * Use constant arrays=true [2018-11-23 05:14:44,771 INFO L133 SettingsManager]: * Pointer base address is valid at dereference=IGNORE [2018-11-23 05:14:44,772 INFO L131 SettingsManager]: Preferences of RCFGBuilder differ from their defaults: [2018-11-23 05:14:44,772 INFO L133 SettingsManager]: * Size of a code block=SequenceOfStatements [2018-11-23 05:14:44,772 INFO L133 SettingsManager]: * To the following directory=./dump/ [2018-11-23 05:14:44,772 INFO L133 SettingsManager]: * SMT solver=External_DefaultMode [2018-11-23 05:14:44,772 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 05:14:44,772 INFO L131 SettingsManager]: Preferences of TraceAbstraction differ from their defaults: [2018-11-23 05:14:44,772 INFO L133 SettingsManager]: * Compute Interpolants along a Counterexample=FPandBP [2018-11-23 05:14:44,773 INFO L133 SettingsManager]: * Positions where we compute the Hoare Annotation=LoopsAndPotentialCycles [2018-11-23 05:14:44,773 INFO L133 SettingsManager]: * Trace refinement strategy=CAMEL [2018-11-23 05:14:44,773 INFO L133 SettingsManager]: * SMT solver=External_ModelsAndUnsatCoreMode [2018-11-23 05:14:44,773 INFO L133 SettingsManager]: * Command for external solver=z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in [2018-11-23 05:14:44,773 INFO L133 SettingsManager]: * Compute Hoare Annotation of negated interpolant automaton, abstraction and CFG=true [2018-11-23 05:14:44,773 INFO L133 SettingsManager]: * To the following directory=dump/ Applying setting for plugin de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: Entry function -> main Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness directory -> /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Witness filename -> witness.graphml Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Write witness besides input file -> false Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data specification -> CHECK( init(main()), LTL(G ! call(__VERIFIER_error())) ) Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data producer -> Automizer Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data architecture -> 64bit Applying setting for plugin de.uni_freiburg.informatik.ultimate.witnessprinter: Graph data programhash -> 6186ef142a0a91a64444136f0ec69676cad8008d [2018-11-23 05:14:44,797 INFO L81 nceAwareModelManager]: Repository-Root is: /tmp [2018-11-23 05:14:44,807 INFO L258 ainManager$Toolchain]: [Toolchain 1]: Applicable parser(s) successfully (re)initialized [2018-11-23 05:14:44,810 INFO L214 ainManager$Toolchain]: [Toolchain 1]: Toolchain selected. [2018-11-23 05:14:44,811 INFO L271 PluginConnector]: Initializing CDTParser... [2018-11-23 05:14:44,811 INFO L276 PluginConnector]: CDTParser initialized [2018-11-23 05:14:44,812 INFO L418 ainManager$Toolchain]: [Toolchain 1]: Parsing single file: /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/../../sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_ppp.ko-entry_point_false-unreach-call.cil.out.c [2018-11-23 05:14:44,855 INFO L221 CDTParser]: Created temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/data/e56e8515a/d1b3a4a4ce2e47519efb4aaa14d01a37/FLAGb380267d1 [2018-11-23 05:14:45,347 INFO L307 CDTParser]: Found 1 translation units. [2018-11-23 05:14:45,348 INFO L161 CDTParser]: Scanning /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/sv-benchmarks/c/ldv-linux-3.16-rc1/205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_ppp.ko-entry_point_false-unreach-call.cil.out.c [2018-11-23 05:14:45,366 INFO L355 CDTParser]: About to delete temporary CDT project at /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/data/e56e8515a/d1b3a4a4ce2e47519efb4aaa14d01a37/FLAGb380267d1 [2018-11-23 05:14:45,830 INFO L363 CDTParser]: Successfully deleted /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/data/e56e8515a/d1b3a4a4ce2e47519efb4aaa14d01a37 [2018-11-23 05:14:45,833 INFO L296 ainManager$Toolchain]: ####################### [Toolchain 1] ####################### [2018-11-23 05:14:45,834 INFO L131 ToolchainWalker]: Walking toolchain with 6 elements. [2018-11-23 05:14:45,835 INFO L113 PluginConnector]: ------------------------CACSL2BoogieTranslator---------------------------- [2018-11-23 05:14:45,835 INFO L271 PluginConnector]: Initializing CACSL2BoogieTranslator... [2018-11-23 05:14:45,837 INFO L276 PluginConnector]: CACSL2BoogieTranslator initialized [2018-11-23 05:14:45,838 INFO L185 PluginConnector]: Executing the observer ACSLObjectContainerObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 05:14:45" (1/1) ... [2018-11-23 05:14:45,839 INFO L205 PluginConnector]: Invalid model from CACSL2BoogieTranslator for observer de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.ACSLObjectContainerObserver@459af452 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:45, skipping insertion in model container [2018-11-23 05:14:45,840 INFO L185 PluginConnector]: Executing the observer CACSL2BoogieTranslatorObserver from plugin CACSL2BoogieTranslator for "CDTParser AST 23.11 05:14:45" (1/1) ... [2018-11-23 05:14:45,846 INFO L145 MainTranslator]: Starting translation in SV-COMP mode [2018-11-23 05:14:45,920 INFO L176 MainTranslator]: Built tables and reachable declarations [2018-11-23 05:14:46,830 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 05:14:46,845 INFO L191 MainTranslator]: Completed pre-run [2018-11-23 05:14:46,997 INFO L201 PostProcessor]: Analyzing one entry point: main [2018-11-23 05:14:47,055 INFO L195 MainTranslator]: Completed translation [2018-11-23 05:14:47,056 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:47 WrapperNode [2018-11-23 05:14:47,056 INFO L132 PluginConnector]: ------------------------ END CACSL2BoogieTranslator---------------------------- [2018-11-23 05:14:47,056 INFO L113 PluginConnector]: ------------------------Boogie Procedure Inliner---------------------------- [2018-11-23 05:14:47,057 INFO L271 PluginConnector]: Initializing Boogie Procedure Inliner... [2018-11-23 05:14:47,057 INFO L276 PluginConnector]: Boogie Procedure Inliner initialized [2018-11-23 05:14:47,064 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:47" (1/1) ... [2018-11-23 05:14:47,094 INFO L185 PluginConnector]: Executing the observer Inliner from plugin Boogie Procedure Inliner for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:47" (1/1) ... [2018-11-23 05:14:47,104 INFO L132 PluginConnector]: ------------------------ END Boogie Procedure Inliner---------------------------- [2018-11-23 05:14:47,105 INFO L113 PluginConnector]: ------------------------Boogie Preprocessor---------------------------- [2018-11-23 05:14:47,105 INFO L271 PluginConnector]: Initializing Boogie Preprocessor... [2018-11-23 05:14:47,105 INFO L276 PluginConnector]: Boogie Preprocessor initialized [2018-11-23 05:14:47,111 INFO L185 PluginConnector]: Executing the observer EnsureBoogieModelObserver from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:47" (1/1) ... [2018-11-23 05:14:47,111 INFO L185 PluginConnector]: Executing the observer TypeChecker from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:47" (1/1) ... [2018-11-23 05:14:47,121 INFO L185 PluginConnector]: Executing the observer ConstExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:47" (1/1) ... [2018-11-23 05:14:47,121 INFO L185 PluginConnector]: Executing the observer StructExpander from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:47" (1/1) ... [2018-11-23 05:14:47,163 INFO L185 PluginConnector]: Executing the observer UnstructureCode from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:47" (1/1) ... [2018-11-23 05:14:47,172 INFO L185 PluginConnector]: Executing the observer FunctionInliner from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:47" (1/1) ... [2018-11-23 05:14:47,180 INFO L185 PluginConnector]: Executing the observer BoogieSymbolTableConstructor from plugin Boogie Preprocessor for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:47" (1/1) ... [2018-11-23 05:14:47,189 INFO L132 PluginConnector]: ------------------------ END Boogie Preprocessor---------------------------- [2018-11-23 05:14:47,189 INFO L113 PluginConnector]: ------------------------RCFGBuilder---------------------------- [2018-11-23 05:14:47,189 INFO L271 PluginConnector]: Initializing RCFGBuilder... [2018-11-23 05:14:47,189 INFO L276 PluginConnector]: RCFGBuilder initialized [2018-11-23 05:14:47,190 INFO L185 PluginConnector]: Executing the observer RCFGBuilderObserver from plugin RCFGBuilder for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:47" (1/1) ... No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/z3 Starting monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 1 with z3 SMTLIB2_COMPLIANT=true -memory:2024 -smt2 -in -t:2000 [2018-11-23 05:14:47,236 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_dev_alloc_skb_13 [2018-11-23 05:14:47,237 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_dev_alloc_skb_13 [2018-11-23 05:14:47,237 INFO L130 BoogieDeclarations]: Found specification of procedure ppp_hard_header [2018-11-23 05:14:47,237 INFO L138 BoogieDeclarations]: Found implementation of procedure ppp_hard_header [2018-11-23 05:14:47,237 INFO L130 BoogieDeclarations]: Found specification of procedure __raw_spin_lock_init [2018-11-23 05:14:47,237 INFO L130 BoogieDeclarations]: Found specification of procedure ppp_start [2018-11-23 05:14:47,237 INFO L138 BoogieDeclarations]: Found implementation of procedure ppp_start [2018-11-23 05:14:47,237 INFO L130 BoogieDeclarations]: Found specification of procedure ppp_rx [2018-11-23 05:14:47,238 INFO L138 BoogieDeclarations]: Found implementation of procedure ppp_rx [2018-11-23 05:14:47,239 INFO L130 BoogieDeclarations]: Found specification of procedure write~unchecked~int [2018-11-23 05:14:47,239 INFO L130 BoogieDeclarations]: Found specification of procedure ppp_type_trans [2018-11-23 05:14:47,239 INFO L138 BoogieDeclarations]: Found implementation of procedure ppp_type_trans [2018-11-23 05:14:47,239 INFO L130 BoogieDeclarations]: Found specification of procedure ##fun~$Pointer$~X~int~X~int~TO~int [2018-11-23 05:14:47,239 INFO L138 BoogieDeclarations]: Found implementation of procedure ##fun~$Pointer$~X~int~X~int~TO~int [2018-11-23 05:14:47,239 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_set_init [2018-11-23 05:14:47,240 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_set_init [2018-11-23 05:14:47,240 INFO L130 BoogieDeclarations]: Found specification of procedure skb_reserve [2018-11-23 05:14:47,240 INFO L138 BoogieDeclarations]: Found implementation of procedure skb_reserve [2018-11-23 05:14:47,240 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.alloc [2018-11-23 05:14:47,240 INFO L130 BoogieDeclarations]: Found specification of procedure activate_pending_timer_1 [2018-11-23 05:14:47,240 INFO L138 BoogieDeclarations]: Found implementation of procedure activate_pending_timer_1 [2018-11-23 05:14:47,240 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_setup_3 [2018-11-23 05:14:47,240 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_stop [2018-11-23 05:14:47,241 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_stop [2018-11-23 05:14:47,241 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_initialize [2018-11-23 05:14:47,241 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_initialize [2018-11-23 05:14:47,241 INFO L130 BoogieDeclarations]: Found specification of procedure dev_queue_xmit [2018-11-23 05:14:47,241 INFO L130 BoogieDeclarations]: Found specification of procedure read~int [2018-11-23 05:14:47,241 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_off [2018-11-23 05:14:47,241 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_off [2018-11-23 05:14:47,241 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.meminit [2018-11-23 05:14:47,241 INFO L138 BoogieDeclarations]: Found implementation of procedure #Ultimate.meminit [2018-11-23 05:14:47,242 INFO L130 BoogieDeclarations]: Found specification of procedure skb_queue_head_init [2018-11-23 05:14:47,242 INFO L138 BoogieDeclarations]: Found implementation of procedure skb_queue_head_init [2018-11-23 05:14:47,242 INFO L130 BoogieDeclarations]: Found specification of procedure dev_to_hdlc [2018-11-23 05:14:47,242 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_to_hdlc [2018-11-23 05:14:47,242 INFO L130 BoogieDeclarations]: Found specification of procedure skb_push [2018-11-23 05:14:47,242 INFO L130 BoogieDeclarations]: Found specification of procedure #Ultimate.C_memcpy [2018-11-23 05:14:47,242 INFO L138 BoogieDeclarations]: Found implementation of procedure #Ultimate.C_memcpy [2018-11-23 05:14:47,242 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_disconnect_3 [2018-11-23 05:14:47,243 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_malloc [2018-11-23 05:14:47,243 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_malloc [2018-11-23 05:14:47,243 INFO L130 BoogieDeclarations]: Found specification of procedure netif_dormant_on [2018-11-23 05:14:47,243 INFO L138 BoogieDeclarations]: Found implementation of procedure netif_dormant_on [2018-11-23 05:14:47,243 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_alloc [2018-11-23 05:14:47,243 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_alloc [2018-11-23 05:14:47,243 INFO L130 BoogieDeclarations]: Found specification of procedure kfree [2018-11-23 05:14:47,243 INFO L130 BoogieDeclarations]: Found specification of procedure __skb_queue_head_init [2018-11-23 05:14:47,243 INFO L138 BoogieDeclarations]: Found implementation of procedure __skb_queue_head_init [2018-11-23 05:14:47,244 INFO L130 BoogieDeclarations]: Found specification of procedure write~int [2018-11-23 05:14:47,244 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_error [2018-11-23 05:14:47,244 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_error [2018-11-23 05:14:47,244 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_release_3 [2018-11-23 05:14:47,244 INFO L130 BoogieDeclarations]: Found specification of procedure ppp_tx_flush [2018-11-23 05:14:47,244 INFO L138 BoogieDeclarations]: Found implementation of procedure ppp_tx_flush [2018-11-23 05:14:47,244 INFO L130 BoogieDeclarations]: Found specification of procedure skb_pull [2018-11-23 05:14:47,244 INFO L130 BoogieDeclarations]: Found specification of procedure skb_reset_network_header [2018-11-23 05:14:47,244 INFO L138 BoogieDeclarations]: Found implementation of procedure skb_reset_network_header [2018-11-23 05:14:47,244 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_skb_dequeue_12 [2018-11-23 05:14:47,244 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_skb_dequeue_12 [2018-11-23 05:14:47,245 INFO L130 BoogieDeclarations]: Found specification of procedure ldv__builtin_expect [2018-11-23 05:14:47,245 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv__builtin_expect [2018-11-23 05:14:47,245 INFO L130 BoogieDeclarations]: Found specification of procedure ppp_timer [2018-11-23 05:14:47,245 INFO L138 BoogieDeclarations]: Found implementation of procedure ppp_timer [2018-11-23 05:14:47,245 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_open_3 [2018-11-23 05:14:47,245 INFO L130 BoogieDeclarations]: Found specification of procedure del_timer [2018-11-23 05:14:47,245 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.init [2018-11-23 05:14:47,245 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.init [2018-11-23 05:14:47,245 INFO L130 BoogieDeclarations]: Found specification of procedure disable_suitable_timer_1 [2018-11-23 05:14:47,245 INFO L138 BoogieDeclarations]: Found implementation of procedure disable_suitable_timer_1 [2018-11-23 05:14:47,246 INFO L130 BoogieDeclarations]: Found specification of procedure test_and_set_bit [2018-11-23 05:14:47,246 INFO L138 BoogieDeclarations]: Found implementation of procedure test_and_set_bit [2018-11-23 05:14:47,246 INFO L130 BoogieDeclarations]: Found specification of procedure spinlock_check [2018-11-23 05:14:47,246 INFO L138 BoogieDeclarations]: Found implementation of procedure spinlock_check [2018-11-23 05:14:47,246 INFO L130 BoogieDeclarations]: Found specification of procedure dev_kfree_skb_any [2018-11-23 05:14:47,246 INFO L138 BoogieDeclarations]: Found implementation of procedure dev_kfree_skb_any [2018-11-23 05:14:47,246 INFO L130 BoogieDeclarations]: Found specification of procedure __kmalloc [2018-11-23 05:14:47,246 INFO L138 BoogieDeclarations]: Found implementation of procedure __kmalloc [2018-11-23 05:14:47,246 INFO L130 BoogieDeclarations]: Found specification of procedure main [2018-11-23 05:14:47,246 INFO L138 BoogieDeclarations]: Found implementation of procedure main [2018-11-23 05:14:47,247 INFO L130 BoogieDeclarations]: Found specification of procedure get_ppp [2018-11-23 05:14:47,247 INFO L138 BoogieDeclarations]: Found implementation of procedure get_ppp [2018-11-23 05:14:47,247 INFO L130 BoogieDeclarations]: Found specification of procedure write~$Pointer$ [2018-11-23 05:14:47,247 INFO L130 BoogieDeclarations]: Found specification of procedure get_proto [2018-11-23 05:14:47,247 INFO L138 BoogieDeclarations]: Found implementation of procedure get_proto [2018-11-23 05:14:47,247 INFO L130 BoogieDeclarations]: Found specification of procedure memcmp [2018-11-23 05:14:47,247 INFO L130 BoogieDeclarations]: Found specification of procedure reg_timer_1 [2018-11-23 05:14:47,247 INFO L138 BoogieDeclarations]: Found implementation of procedure reg_timer_1 [2018-11-23 05:14:47,247 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_set_add [2018-11-23 05:14:47,247 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_set_add [2018-11-23 05:14:47,248 INFO L130 BoogieDeclarations]: Found specification of procedure ppp_close [2018-11-23 05:14:47,248 INFO L138 BoogieDeclarations]: Found implementation of procedure ppp_close [2018-11-23 05:14:47,248 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_unlock_irqrestore [2018-11-23 05:14:47,248 INFO L130 BoogieDeclarations]: Found specification of procedure ppp_tx_cp [2018-11-23 05:14:47,248 INFO L138 BoogieDeclarations]: Found implementation of procedure ppp_tx_cp [2018-11-23 05:14:47,248 INFO L130 BoogieDeclarations]: Found specification of procedure read~$Pointer$ [2018-11-23 05:14:47,248 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_set_is_empty [2018-11-23 05:14:47,248 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_set_is_empty [2018-11-23 05:14:47,248 INFO L130 BoogieDeclarations]: Found specification of procedure attach_hdlc_protocol [2018-11-23 05:14:47,248 INFO L130 BoogieDeclarations]: Found specification of procedure add_timer [2018-11-23 05:14:47,248 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_mod_timer_15 [2018-11-23 05:14:47,249 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_mod_timer_15 [2018-11-23 05:14:47,249 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_mod_timer_14 [2018-11-23 05:14:47,249 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_mod_timer_14 [2018-11-23 05:14:47,249 INFO L130 BoogieDeclarations]: Found specification of procedure mod_timer [2018-11-23 05:14:47,249 INFO L130 BoogieDeclarations]: Found specification of procedure register_hdlc_protocol [2018-11-23 05:14:47,249 INFO L130 BoogieDeclarations]: Found specification of procedure spin_unlock_irqrestore [2018-11-23 05:14:47,249 INFO L138 BoogieDeclarations]: Found implementation of procedure spin_unlock_irqrestore [2018-11-23 05:14:47,249 INFO L130 BoogieDeclarations]: Found specification of procedure ppp_cp_parse_cr [2018-11-23 05:14:47,249 INFO L138 BoogieDeclarations]: Found implementation of procedure ppp_cp_parse_cr [2018-11-23 05:14:47,249 INFO L130 BoogieDeclarations]: Found specification of procedure ppp_stop [2018-11-23 05:14:47,249 INFO L138 BoogieDeclarations]: Found implementation of procedure ppp_stop [2018-11-23 05:14:47,250 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.dealloc [2018-11-23 05:14:47,250 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~$Pointer$ [2018-11-23 05:14:47,250 INFO L130 BoogieDeclarations]: Found specification of procedure skb_queue_tail [2018-11-23 05:14:47,250 INFO L130 BoogieDeclarations]: Found specification of procedure ppp_cp_event [2018-11-23 05:14:47,250 INFO L138 BoogieDeclarations]: Found implementation of procedure ppp_cp_event [2018-11-23 05:14:47,250 INFO L130 BoogieDeclarations]: Found specification of procedure capable [2018-11-23 05:14:47,250 INFO L130 BoogieDeclarations]: Found specification of procedure unregister_hdlc_protocol [2018-11-23 05:14:47,250 INFO L130 BoogieDeclarations]: Found specification of procedure skb_put [2018-11-23 05:14:47,250 INFO L130 BoogieDeclarations]: Found specification of procedure kmalloc [2018-11-23 05:14:47,250 INFO L138 BoogieDeclarations]: Found implementation of procedure kmalloc [2018-11-23 05:14:47,251 INFO L130 BoogieDeclarations]: Found specification of procedure __fswab16 [2018-11-23 05:14:47,251 INFO L138 BoogieDeclarations]: Found implementation of procedure __fswab16 [2018-11-23 05:14:47,251 INFO L130 BoogieDeclarations]: Found specification of procedure _raw_spin_lock_irqsave [2018-11-23 05:14:47,251 INFO L130 BoogieDeclarations]: Found specification of procedure ##fun~int~TO~VOID [2018-11-23 05:14:47,251 INFO L138 BoogieDeclarations]: Found implementation of procedure ##fun~int~TO~VOID [2018-11-23 05:14:47,251 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_initialize_hdlc_proto_3 [2018-11-23 05:14:47,251 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_initialize_hdlc_proto_3 [2018-11-23 05:14:47,251 INFO L130 BoogieDeclarations]: Found specification of procedure ppp_ioctl [2018-11-23 05:14:47,251 INFO L138 BoogieDeclarations]: Found implementation of procedure ppp_ioctl [2018-11-23 05:14:47,251 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_del_timer_16 [2018-11-23 05:14:47,252 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_del_timer_16 [2018-11-23 05:14:47,252 INFO L130 BoogieDeclarations]: Found specification of procedure netdev_priv [2018-11-23 05:14:47,252 INFO L138 BoogieDeclarations]: Found implementation of procedure netdev_priv [2018-11-23 05:14:47,252 INFO L130 BoogieDeclarations]: Found specification of procedure choose_timer_1 [2018-11-23 05:14:47,252 INFO L138 BoogieDeclarations]: Found implementation of procedure choose_timer_1 [2018-11-23 05:14:47,252 INFO L130 BoogieDeclarations]: Found specification of procedure mod_init [2018-11-23 05:14:47,252 INFO L138 BoogieDeclarations]: Found implementation of procedure mod_init [2018-11-23 05:14:47,252 INFO L130 BoogieDeclarations]: Found specification of procedure proto_name [2018-11-23 05:14:47,252 INFO L138 BoogieDeclarations]: Found implementation of procedure proto_name [2018-11-23 05:14:47,253 INFO L130 BoogieDeclarations]: Found specification of procedure write~init~int [2018-11-23 05:14:47,253 INFO L130 BoogieDeclarations]: Found specification of procedure linkwatch_fire_event [2018-11-23 05:14:47,253 INFO L130 BoogieDeclarations]: Found specification of procedure __dev_kfree_skb_any [2018-11-23 05:14:47,253 INFO L130 BoogieDeclarations]: Found specification of procedure test_and_clear_bit [2018-11-23 05:14:47,253 INFO L138 BoogieDeclarations]: Found implementation of procedure test_and_clear_bit [2018-11-23 05:14:47,253 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_check_final_state [2018-11-23 05:14:47,253 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_check_final_state [2018-11-23 05:14:47,253 INFO L130 BoogieDeclarations]: Found specification of procedure ldv_zalloc [2018-11-23 05:14:47,253 INFO L138 BoogieDeclarations]: Found implementation of procedure ldv_zalloc [2018-11-23 05:14:47,253 INFO L130 BoogieDeclarations]: Found specification of procedure mod_exit [2018-11-23 05:14:47,254 INFO L138 BoogieDeclarations]: Found implementation of procedure mod_exit [2018-11-23 05:14:47,254 INFO L130 BoogieDeclarations]: Found specification of procedure ULTIMATE.start [2018-11-23 05:14:47,254 INFO L138 BoogieDeclarations]: Found implementation of procedure ULTIMATE.start [2018-11-23 05:14:48,511 INFO L275 CfgBuilder]: Using the 1 location(s) as analysis (start of procedure ULTIMATE.start) [2018-11-23 05:14:48,511 INFO L280 CfgBuilder]: Removed 1 assue(true) statements. [2018-11-23 05:14:48,511 INFO L202 PluginConnector]: Adding new model de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 05:14:48 BoogieIcfgContainer [2018-11-23 05:14:48,511 INFO L132 PluginConnector]: ------------------------ END RCFGBuilder---------------------------- [2018-11-23 05:14:48,512 INFO L113 PluginConnector]: ------------------------TraceAbstraction---------------------------- [2018-11-23 05:14:48,512 INFO L271 PluginConnector]: Initializing TraceAbstraction... [2018-11-23 05:14:48,514 INFO L276 PluginConnector]: TraceAbstraction initialized [2018-11-23 05:14:48,514 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "CDTParser AST 23.11 05:14:45" (1/3) ... [2018-11-23 05:14:48,515 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@1a3f2764 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 05:14:48, skipping insertion in model container [2018-11-23 05:14:48,515 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator AST 23.11 05:14:47" (2/3) ... [2018-11-23 05:14:48,515 INFO L205 PluginConnector]: Invalid model from TraceAbstraction for observer de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction.TraceAbstractionObserver@1a3f2764 and model type de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction AST 23.11 05:14:48, skipping insertion in model container [2018-11-23 05:14:48,515 INFO L185 PluginConnector]: Executing the observer TraceAbstractionObserver from plugin TraceAbstraction for "de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder CFG 23.11 05:14:48" (3/3) ... [2018-11-23 05:14:48,517 INFO L112 eAbstractionObserver]: Analyzing ICFG 205_9a_array_unsafes_linux-3.16-rc1.tar.xz-205_9a-drivers--net--wan--hdlc_ppp.ko-entry_point_false-unreach-call.cil.out.c [2018-11-23 05:14:48,523 INFO L156 ceAbstractionStarter]: Automizer settings: Hoare:true NWA Interpolation:FPandBP Determinization: PREDICATE_ABSTRACTION [2018-11-23 05:14:48,529 INFO L168 ceAbstractionStarter]: Appying trace abstraction to program that has 1 error locations. [2018-11-23 05:14:48,540 INFO L257 AbstractCegarLoop]: Starting to check reachability of 1 error locations. [2018-11-23 05:14:48,563 INFO L133 ementStrategyFactory]: Using default assertion order modulation [2018-11-23 05:14:48,564 INFO L382 AbstractCegarLoop]: Interprodecural is true [2018-11-23 05:14:48,564 INFO L383 AbstractCegarLoop]: Hoare is true [2018-11-23 05:14:48,564 INFO L384 AbstractCegarLoop]: Compute interpolants for FPandBP [2018-11-23 05:14:48,564 INFO L385 AbstractCegarLoop]: Backedges is STRAIGHT_LINE [2018-11-23 05:14:48,564 INFO L386 AbstractCegarLoop]: Determinization is PREDICATE_ABSTRACTION [2018-11-23 05:14:48,564 INFO L387 AbstractCegarLoop]: Difference is false [2018-11-23 05:14:48,565 INFO L388 AbstractCegarLoop]: Minimize is MINIMIZE_SEVPA [2018-11-23 05:14:48,565 INFO L393 AbstractCegarLoop]: ======== Iteration 0==of CEGAR loop == AllErrorsAtOnce======== [2018-11-23 05:14:48,586 INFO L276 IsEmpty]: Start isEmpty. Operand 634 states. [2018-11-23 05:14:48,594 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 66 [2018-11-23 05:14:48,594 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 05:14:48,595 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 05:14:48,596 INFO L423 AbstractCegarLoop]: === Iteration 1 === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 05:14:48,600 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 05:14:48,600 INFO L82 PathProgramCache]: Analyzing trace with hash -682356175, now seen corresponding path program 1 times [2018-11-23 05:14:48,601 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 05:14:48,601 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 05:14:48,644 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:48,644 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 05:14:48,644 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:48,741 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 05:14:48,874 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2018-11-23 05:14:48,876 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 05:14:48,876 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 05:14:48,880 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 05:14:48,891 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 05:14:48,892 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 05:14:48,894 INFO L87 Difference]: Start difference. First operand 634 states. Second operand 3 states. [2018-11-23 05:14:49,045 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 05:14:49,045 INFO L93 Difference]: Finished difference Result 1802 states and 2638 transitions. [2018-11-23 05:14:49,046 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 05:14:49,047 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 65 [2018-11-23 05:14:49,047 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 05:14:49,063 INFO L225 Difference]: With dead ends: 1802 [2018-11-23 05:14:49,063 INFO L226 Difference]: Without dead ends: 1171 [2018-11-23 05:14:49,070 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 05:14:49,084 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1171 states. [2018-11-23 05:14:49,149 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1171 to 1171. [2018-11-23 05:14:49,150 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 1171 states. [2018-11-23 05:14:49,156 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1171 states to 1171 states and 1642 transitions. [2018-11-23 05:14:49,158 INFO L78 Accepts]: Start accepts. Automaton has 1171 states and 1642 transitions. Word has length 65 [2018-11-23 05:14:49,158 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 05:14:49,158 INFO L480 AbstractCegarLoop]: Abstraction has 1171 states and 1642 transitions. [2018-11-23 05:14:49,158 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 05:14:49,158 INFO L276 IsEmpty]: Start isEmpty. Operand 1171 states and 1642 transitions. [2018-11-23 05:14:49,163 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 83 [2018-11-23 05:14:49,163 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 05:14:49,163 INFO L402 BasicCegarLoop]: trace histogram [5, 5, 5, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 05:14:49,164 INFO L423 AbstractCegarLoop]: === Iteration 2 === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 05:14:49,164 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 05:14:49,164 INFO L82 PathProgramCache]: Analyzing trace with hash -1968822385, now seen corresponding path program 1 times [2018-11-23 05:14:49,164 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 05:14:49,164 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 05:14:49,169 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:49,169 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 05:14:49,169 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:49,197 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 05:14:49,271 INFO L134 CoverageAnalysis]: Checked inductivity of 40 backedges. 0 proven. 0 refuted. 0 times theorem prover too weak. 40 trivial. 0 not checked. [2018-11-23 05:14:49,272 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 05:14:49,272 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2018-11-23 05:14:49,273 INFO L459 AbstractCegarLoop]: Interpolant automaton has 5 states [2018-11-23 05:14:49,273 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2018-11-23 05:14:49,274 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2018-11-23 05:14:49,275 INFO L87 Difference]: Start difference. First operand 1171 states and 1642 transitions. Second operand 5 states. [2018-11-23 05:14:49,370 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 05:14:49,370 INFO L93 Difference]: Finished difference Result 2317 states and 3253 transitions. [2018-11-23 05:14:49,371 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2018-11-23 05:14:49,371 INFO L78 Accepts]: Start accepts. Automaton has 5 states. Word has length 82 [2018-11-23 05:14:49,371 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 05:14:49,377 INFO L225 Difference]: With dead ends: 2317 [2018-11-23 05:14:49,377 INFO L226 Difference]: Without dead ends: 1170 [2018-11-23 05:14:49,382 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 7 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 5 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 1 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=15, Invalid=27, Unknown=0, NotChecked=0, Total=42 [2018-11-23 05:14:49,383 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 1170 states. [2018-11-23 05:14:49,415 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 1170 to 1170. [2018-11-23 05:14:49,415 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 1170 states. [2018-11-23 05:14:49,419 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 1170 states to 1170 states and 1638 transitions. [2018-11-23 05:14:49,420 INFO L78 Accepts]: Start accepts. Automaton has 1170 states and 1638 transitions. Word has length 82 [2018-11-23 05:14:49,420 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 05:14:49,420 INFO L480 AbstractCegarLoop]: Abstraction has 1170 states and 1638 transitions. [2018-11-23 05:14:49,421 INFO L481 AbstractCegarLoop]: Interpolant automaton has 5 states. [2018-11-23 05:14:49,421 INFO L276 IsEmpty]: Start isEmpty. Operand 1170 states and 1638 transitions. [2018-11-23 05:14:49,426 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 110 [2018-11-23 05:14:49,426 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 05:14:49,426 INFO L402 BasicCegarLoop]: trace histogram [7, 7, 7, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 05:14:49,427 INFO L423 AbstractCegarLoop]: === Iteration 3 === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 05:14:49,427 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 05:14:49,427 INFO L82 PathProgramCache]: Analyzing trace with hash 697504420, now seen corresponding path program 1 times [2018-11-23 05:14:49,427 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 05:14:49,427 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 05:14:49,431 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:49,431 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 05:14:49,431 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:49,453 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 05:14:49,560 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 0 proven. 5 refuted. 0 times theorem prover too weak. 84 trivial. 0 not checked. [2018-11-23 05:14:49,560 INFO L300 seRefinementStrategy]: The current sequences of interpolants are not accepted, trying to find more. [2018-11-23 05:14:49,561 INFO L223 ckRefinementStrategy]: Switched to mode Z3_FP No working directory specified, using /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/z3 Starting monitored process 2 with z3 -smt2 -in SMTLIB2_COMPLIANT=true -t:12000 (exit command is (exit), workingDir is null) Waiting until toolchain timeout for monitored process 2 with z3 -smt2 -in SMTLIB2_COMPLIANT=true -t:12000 [2018-11-23 05:14:49,585 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 05:14:49,757 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 05:14:49,771 INFO L273 TraceCheckSpWp]: Computing forward predicates... [2018-11-23 05:14:49,841 INFO L134 CoverageAnalysis]: Checked inductivity of 89 backedges. 40 proven. 0 refuted. 0 times theorem prover too weak. 49 trivial. 0 not checked. [2018-11-23 05:14:49,868 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 1 imperfect interpolant sequences. [2018-11-23 05:14:49,868 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [6] imperfect sequences [7] total 10 [2018-11-23 05:14:49,868 INFO L459 AbstractCegarLoop]: Interpolant automaton has 10 states [2018-11-23 05:14:49,868 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 10 interpolants. [2018-11-23 05:14:49,869 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=22, Invalid=68, Unknown=0, NotChecked=0, Total=90 [2018-11-23 05:14:49,869 INFO L87 Difference]: Start difference. First operand 1170 states and 1638 transitions. Second operand 10 states. [2018-11-23 05:14:51,368 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 05:14:51,369 INFO L93 Difference]: Finished difference Result 3463 states and 5054 transitions. [2018-11-23 05:14:51,369 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 8 states. [2018-11-23 05:14:51,369 INFO L78 Accepts]: Start accepts. Automaton has 10 states. Word has length 109 [2018-11-23 05:14:51,369 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 05:14:51,384 INFO L225 Difference]: With dead ends: 3463 [2018-11-23 05:14:51,384 INFO L226 Difference]: Without dead ends: 2304 [2018-11-23 05:14:51,394 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 119 GetRequests, 108 SyntacticMatches, 1 SemanticMatches, 10 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 13 ImplicationChecksByTransitivity, 0.1s TimeCoverageRelationStatistics Valid=32, Invalid=100, Unknown=0, NotChecked=0, Total=132 [2018-11-23 05:14:51,397 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2304 states. [2018-11-23 05:14:51,519 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2304 to 2304. [2018-11-23 05:14:51,520 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 2304 states. [2018-11-23 05:14:51,529 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 2304 states to 2304 states and 3331 transitions. [2018-11-23 05:14:51,530 INFO L78 Accepts]: Start accepts. Automaton has 2304 states and 3331 transitions. Word has length 109 [2018-11-23 05:14:51,530 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 05:14:51,530 INFO L480 AbstractCegarLoop]: Abstraction has 2304 states and 3331 transitions. [2018-11-23 05:14:51,531 INFO L481 AbstractCegarLoop]: Interpolant automaton has 10 states. [2018-11-23 05:14:51,531 INFO L276 IsEmpty]: Start isEmpty. Operand 2304 states and 3331 transitions. [2018-11-23 05:14:51,539 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 157 [2018-11-23 05:14:51,539 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 05:14:51,539 INFO L402 BasicCegarLoop]: trace histogram [8, 8, 8, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 05:14:51,539 INFO L423 AbstractCegarLoop]: === Iteration 4 === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 05:14:51,540 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 05:14:51,540 INFO L82 PathProgramCache]: Analyzing trace with hash -305676393, now seen corresponding path program 1 times [2018-11-23 05:14:51,540 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 05:14:51,540 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 05:14:51,542 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:51,542 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 05:14:51,542 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:51,566 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 05:14:51,632 INFO L134 CoverageAnalysis]: Checked inductivity of 123 backedges. 6 proven. 0 refuted. 0 times theorem prover too weak. 117 trivial. 0 not checked. [2018-11-23 05:14:51,632 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 05:14:51,632 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 05:14:51,632 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 05:14:51,632 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 05:14:51,633 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 05:14:51,633 INFO L87 Difference]: Start difference. First operand 2304 states and 3331 transitions. Second operand 3 states. [2018-11-23 05:14:51,776 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 05:14:51,776 INFO L93 Difference]: Finished difference Result 4746 states and 6695 transitions. [2018-11-23 05:14:51,776 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 05:14:51,777 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 156 [2018-11-23 05:14:51,777 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 05:14:51,787 INFO L225 Difference]: With dead ends: 4746 [2018-11-23 05:14:51,787 INFO L226 Difference]: Without dead ends: 2466 [2018-11-23 05:14:51,794 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 05:14:51,797 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 2466 states. [2018-11-23 05:14:51,857 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 2466 to 2446. [2018-11-23 05:14:51,857 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 2446 states. [2018-11-23 05:14:51,863 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 2446 states to 2446 states and 3370 transitions. [2018-11-23 05:14:51,863 INFO L78 Accepts]: Start accepts. Automaton has 2446 states and 3370 transitions. Word has length 156 [2018-11-23 05:14:51,864 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 05:14:51,864 INFO L480 AbstractCegarLoop]: Abstraction has 2446 states and 3370 transitions. [2018-11-23 05:14:51,864 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 05:14:51,864 INFO L276 IsEmpty]: Start isEmpty. Operand 2446 states and 3370 transitions. [2018-11-23 05:14:51,867 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 157 [2018-11-23 05:14:51,868 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 05:14:51,868 INFO L402 BasicCegarLoop]: trace histogram [8, 8, 8, 3, 3, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 05:14:51,868 INFO L423 AbstractCegarLoop]: === Iteration 5 === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 05:14:51,868 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 05:14:51,868 INFO L82 PathProgramCache]: Analyzing trace with hash 226006737, now seen corresponding path program 2 times [2018-11-23 05:14:51,868 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 05:14:51,868 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 05:14:51,870 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:51,870 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 05:14:51,870 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:51,891 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 05:14:51,948 INFO L134 CoverageAnalysis]: Checked inductivity of 123 backedges. 11 proven. 0 refuted. 0 times theorem prover too weak. 112 trivial. 0 not checked. [2018-11-23 05:14:51,948 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 05:14:51,948 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 05:14:51,948 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 05:14:51,949 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 05:14:51,949 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 05:14:51,949 INFO L87 Difference]: Start difference. First operand 2446 states and 3370 transitions. Second operand 3 states. [2018-11-23 05:14:52,118 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 05:14:52,118 INFO L93 Difference]: Finished difference Result 5322 states and 7421 transitions. [2018-11-23 05:14:52,119 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 05:14:52,119 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 156 [2018-11-23 05:14:52,119 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 05:14:52,132 INFO L225 Difference]: With dead ends: 5322 [2018-11-23 05:14:52,132 INFO L226 Difference]: Without dead ends: 3500 [2018-11-23 05:14:52,138 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 05:14:52,140 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 3500 states. [2018-11-23 05:14:52,267 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 3500 to 3444. [2018-11-23 05:14:52,267 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 3444 states. [2018-11-23 05:14:52,276 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 3444 states to 3444 states and 4776 transitions. [2018-11-23 05:14:52,276 INFO L78 Accepts]: Start accepts. Automaton has 3444 states and 4776 transitions. Word has length 156 [2018-11-23 05:14:52,277 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 05:14:52,277 INFO L480 AbstractCegarLoop]: Abstraction has 3444 states and 4776 transitions. [2018-11-23 05:14:52,277 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 05:14:52,277 INFO L276 IsEmpty]: Start isEmpty. Operand 3444 states and 4776 transitions. [2018-11-23 05:14:52,282 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 173 [2018-11-23 05:14:52,282 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 05:14:52,282 INFO L402 BasicCegarLoop]: trace histogram [8, 8, 8, 4, 4, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 05:14:52,282 INFO L423 AbstractCegarLoop]: === Iteration 6 === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 05:14:52,283 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 05:14:52,283 INFO L82 PathProgramCache]: Analyzing trace with hash 420724556, now seen corresponding path program 1 times [2018-11-23 05:14:52,283 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 05:14:52,283 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 05:14:52,284 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:52,284 INFO L101 rtionOrderModulation]: Changing assertion order to NOT_INCREMENTALLY [2018-11-23 05:14:52,285 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:52,309 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 05:14:52,365 INFO L134 CoverageAnalysis]: Checked inductivity of 140 backedges. 25 proven. 0 refuted. 0 times theorem prover too weak. 115 trivial. 0 not checked. [2018-11-23 05:14:52,365 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 05:14:52,365 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 05:14:52,366 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 05:14:52,366 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 05:14:52,366 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 05:14:52,366 INFO L87 Difference]: Start difference. First operand 3444 states and 4776 transitions. Second operand 3 states. [2018-11-23 05:14:52,553 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 05:14:52,553 INFO L93 Difference]: Finished difference Result 7316 states and 10229 transitions. [2018-11-23 05:14:52,554 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 05:14:52,554 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 172 [2018-11-23 05:14:52,554 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 05:14:52,572 INFO L225 Difference]: With dead ends: 7316 [2018-11-23 05:14:52,572 INFO L226 Difference]: Without dead ends: 4496 [2018-11-23 05:14:52,581 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 05:14:52,586 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 4496 states. [2018-11-23 05:14:52,685 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 4496 to 4440. [2018-11-23 05:14:52,685 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 4440 states. [2018-11-23 05:14:52,697 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 4440 states to 4440 states and 6180 transitions. [2018-11-23 05:14:52,698 INFO L78 Accepts]: Start accepts. Automaton has 4440 states and 6180 transitions. Word has length 172 [2018-11-23 05:14:52,698 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 05:14:52,698 INFO L480 AbstractCegarLoop]: Abstraction has 4440 states and 6180 transitions. [2018-11-23 05:14:52,698 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 05:14:52,698 INFO L276 IsEmpty]: Start isEmpty. Operand 4440 states and 6180 transitions. [2018-11-23 05:14:52,705 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 189 [2018-11-23 05:14:52,705 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 05:14:52,705 INFO L402 BasicCegarLoop]: trace histogram [8, 8, 8, 3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 05:14:52,706 INFO L423 AbstractCegarLoop]: === Iteration 7 === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 05:14:52,706 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 05:14:52,706 INFO L82 PathProgramCache]: Analyzing trace with hash -517551368, now seen corresponding path program 1 times [2018-11-23 05:14:52,706 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 05:14:52,706 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 05:14:52,708 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:52,708 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 05:14:52,708 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:52,729 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 05:14:52,811 INFO L134 CoverageAnalysis]: Checked inductivity of 124 backedges. 21 proven. 0 refuted. 0 times theorem prover too weak. 103 trivial. 0 not checked. [2018-11-23 05:14:52,812 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 05:14:52,812 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [5] imperfect sequences [] total 5 [2018-11-23 05:14:52,812 INFO L459 AbstractCegarLoop]: Interpolant automaton has 5 states [2018-11-23 05:14:52,812 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 5 interpolants. [2018-11-23 05:14:52,812 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2018-11-23 05:14:52,813 INFO L87 Difference]: Start difference. First operand 4440 states and 6180 transitions. Second operand 5 states. [2018-11-23 05:14:52,983 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 05:14:52,983 INFO L93 Difference]: Finished difference Result 8916 states and 12924 transitions. [2018-11-23 05:14:52,984 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 5 states. [2018-11-23 05:14:52,984 INFO L78 Accepts]: Start accepts. Automaton has 5 states. Word has length 188 [2018-11-23 05:14:52,984 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 05:14:53,009 INFO L225 Difference]: With dead ends: 8916 [2018-11-23 05:14:53,010 INFO L226 Difference]: Without dead ends: 4500 [2018-11-23 05:14:53,097 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 5 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 3 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=7, Invalid=13, Unknown=0, NotChecked=0, Total=20 [2018-11-23 05:14:53,101 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 4500 states. [2018-11-23 05:14:53,233 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 4500 to 4490. [2018-11-23 05:14:53,234 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 4490 states. [2018-11-23 05:14:53,252 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 4490 states to 4490 states and 6244 transitions. [2018-11-23 05:14:53,253 INFO L78 Accepts]: Start accepts. Automaton has 4490 states and 6244 transitions. Word has length 188 [2018-11-23 05:14:53,254 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 05:14:53,254 INFO L480 AbstractCegarLoop]: Abstraction has 4490 states and 6244 transitions. [2018-11-23 05:14:53,254 INFO L481 AbstractCegarLoop]: Interpolant automaton has 5 states. [2018-11-23 05:14:53,254 INFO L276 IsEmpty]: Start isEmpty. Operand 4490 states and 6244 transitions. [2018-11-23 05:14:53,264 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 196 [2018-11-23 05:14:53,264 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 05:14:53,264 INFO L402 BasicCegarLoop]: trace histogram [8, 8, 7, 3, 3, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 05:14:53,264 INFO L423 AbstractCegarLoop]: === Iteration 8 === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 05:14:53,265 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 05:14:53,265 INFO L82 PathProgramCache]: Analyzing trace with hash -880480738, now seen corresponding path program 1 times [2018-11-23 05:14:53,265 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 05:14:53,265 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 05:14:53,267 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:53,267 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 05:14:53,267 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:53,327 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 05:14:53,700 INFO L134 CoverageAnalysis]: Checked inductivity of 126 backedges. 22 proven. 0 refuted. 0 times theorem prover too weak. 104 trivial. 0 not checked. [2018-11-23 05:14:53,701 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 05:14:53,701 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [11] imperfect sequences [] total 11 [2018-11-23 05:14:53,701 INFO L459 AbstractCegarLoop]: Interpolant automaton has 11 states [2018-11-23 05:14:53,702 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 11 interpolants. [2018-11-23 05:14:53,702 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=19, Invalid=91, Unknown=0, NotChecked=0, Total=110 [2018-11-23 05:14:53,702 INFO L87 Difference]: Start difference. First operand 4490 states and 6244 transitions. Second operand 11 states. [2018-11-23 05:14:54,090 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 05:14:54,091 INFO L93 Difference]: Finished difference Result 9056 states and 13047 transitions. [2018-11-23 05:14:54,092 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 12 states. [2018-11-23 05:14:54,092 INFO L78 Accepts]: Start accepts. Automaton has 11 states. Word has length 195 [2018-11-23 05:14:54,092 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 05:14:54,120 INFO L225 Difference]: With dead ends: 9056 [2018-11-23 05:14:54,120 INFO L226 Difference]: Without dead ends: 4590 [2018-11-23 05:14:54,140 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 15 GetRequests, 3 SyntacticMatches, 0 SemanticMatches, 12 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 3 ImplicationChecksByTransitivity, 0.3s TimeCoverageRelationStatistics Valid=31, Invalid=151, Unknown=0, NotChecked=0, Total=182 [2018-11-23 05:14:54,145 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 4590 states. [2018-11-23 05:14:54,286 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 4590 to 4550. [2018-11-23 05:14:54,286 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 4550 states. [2018-11-23 05:14:54,304 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 4550 states to 4550 states and 6299 transitions. [2018-11-23 05:14:54,306 INFO L78 Accepts]: Start accepts. Automaton has 4550 states and 6299 transitions. Word has length 195 [2018-11-23 05:14:54,306 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 05:14:54,306 INFO L480 AbstractCegarLoop]: Abstraction has 4550 states and 6299 transitions. [2018-11-23 05:14:54,307 INFO L481 AbstractCegarLoop]: Interpolant automaton has 11 states. [2018-11-23 05:14:54,307 INFO L276 IsEmpty]: Start isEmpty. Operand 4550 states and 6299 transitions. [2018-11-23 05:14:54,322 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 250 [2018-11-23 05:14:54,323 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 05:14:54,323 INFO L402 BasicCegarLoop]: trace histogram [9, 9, 8, 3, 3, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 05:14:54,323 INFO L423 AbstractCegarLoop]: === Iteration 9 === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 05:14:54,323 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 05:14:54,323 INFO L82 PathProgramCache]: Analyzing trace with hash 56675422, now seen corresponding path program 1 times [2018-11-23 05:14:54,324 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 05:14:54,324 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 05:14:54,326 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:54,326 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 05:14:54,326 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:54,360 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is unsat [2018-11-23 05:14:54,515 INFO L134 CoverageAnalysis]: Checked inductivity of 177 backedges. 8 proven. 0 refuted. 0 times theorem prover too weak. 169 trivial. 0 not checked. [2018-11-23 05:14:54,515 INFO L312 seRefinementStrategy]: Constructing automaton from 1 perfect and 0 imperfect interpolant sequences. [2018-11-23 05:14:54,515 INFO L327 seRefinementStrategy]: Number of different interpolants: perfect sequences [3] imperfect sequences [] total 3 [2018-11-23 05:14:54,516 INFO L459 AbstractCegarLoop]: Interpolant automaton has 3 states [2018-11-23 05:14:54,516 INFO L142 InterpolantAutomaton]: Constructing interpolant automaton starting with 3 interpolants. [2018-11-23 05:14:54,516 INFO L144 InterpolantAutomaton]: CoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 05:14:54,516 INFO L87 Difference]: Start difference. First operand 4550 states and 6299 transitions. Second operand 3 states. [2018-11-23 05:14:54,635 INFO L144 Difference]: Subtrahend was deterministic. Have not used determinization. [2018-11-23 05:14:54,635 INFO L93 Difference]: Finished difference Result 8460 states and 11768 transitions. [2018-11-23 05:14:54,636 INFO L142 InterpolantAutomaton]: Switched to read-only mode: deterministic interpolant automaton has 3 states. [2018-11-23 05:14:54,636 INFO L78 Accepts]: Start accepts. Automaton has 3 states. Word has length 249 [2018-11-23 05:14:54,637 INFO L84 Accepts]: Finished accepts. some prefix is accepted. [2018-11-23 05:14:54,665 INFO L225 Difference]: With dead ends: 8460 [2018-11-23 05:14:54,666 INFO L226 Difference]: Without dead ends: 4556 [2018-11-23 05:14:54,679 INFO L631 BasicCegarLoop]: 0 DeclaredPredicates, 3 GetRequests, 2 SyntacticMatches, 0 SemanticMatches, 1 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 0 ImplicationChecksByTransitivity, 0.0s TimeCoverageRelationStatistics Valid=3, Invalid=3, Unknown=0, NotChecked=0, Total=6 [2018-11-23 05:14:54,684 INFO L82 GeneralOperation]: Start minimizeSevpa. Operand 4556 states. [2018-11-23 05:14:54,806 INFO L88 GeneralOperation]: Finished minimizeSevpa. Reduced states from 4556 to 4556. [2018-11-23 05:14:54,806 INFO L82 GeneralOperation]: Start removeUnreachable. Operand 4556 states. [2018-11-23 05:14:54,820 INFO L88 GeneralOperation]: Finished removeUnreachable. Reduced from 4556 states to 4556 states and 6305 transitions. [2018-11-23 05:14:54,821 INFO L78 Accepts]: Start accepts. Automaton has 4556 states and 6305 transitions. Word has length 249 [2018-11-23 05:14:54,822 INFO L84 Accepts]: Finished accepts. word is rejected. [2018-11-23 05:14:54,822 INFO L480 AbstractCegarLoop]: Abstraction has 4556 states and 6305 transitions. [2018-11-23 05:14:54,822 INFO L481 AbstractCegarLoop]: Interpolant automaton has 3 states. [2018-11-23 05:14:54,822 INFO L276 IsEmpty]: Start isEmpty. Operand 4556 states and 6305 transitions. [2018-11-23 05:14:54,837 INFO L282 IsEmpty]: Finished isEmpty. Found accepting run of length 215 [2018-11-23 05:14:54,837 INFO L394 BasicCegarLoop]: Found error trace [2018-11-23 05:14:54,838 INFO L402 BasicCegarLoop]: trace histogram [9, 9, 8, 3, 3, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1] [2018-11-23 05:14:54,838 INFO L423 AbstractCegarLoop]: === Iteration 10 === [ldv_errorErr0ASSERT_VIOLATIONERROR_FUNCTION]=== [2018-11-23 05:14:54,838 INFO L141 PredicateUnifier]: Initialized classic predicate unifier [2018-11-23 05:14:54,838 INFO L82 PathProgramCache]: Analyzing trace with hash -1936911654, now seen corresponding path program 1 times [2018-11-23 05:14:54,838 INFO L223 ckRefinementStrategy]: Switched to mode SMTINTERPOL_TREE_INTERPOLANTS [2018-11-23 05:14:54,838 INFO L69 tionRefinementEngine]: Using refinement strategy CamelRefinementStrategy [2018-11-23 05:14:54,840 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:54,840 INFO L103 rtionOrderModulation]: Keeping assertion order NOT_INCREMENTALLY [2018-11-23 05:14:54,841 INFO L119 rtionOrderModulation]: Craig_TreeInterpolation forces the order to NOT_INCREMENTALLY [2018-11-23 05:14:54,900 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-23 05:14:54,962 INFO L136 AnnotateAndAsserter]: Conjunction of SSA is sat [2018-11-23 05:14:55,130 INFO L469 BasicCegarLoop]: Counterexample might be feasible ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.rcfgbuilder.RCFGBacktranslator [?] CALL call ULTIMATE.init(); VAL [|#NULL.base|=4128, |#NULL.offset|=4164, |#t~string114.base|=4136, |#t~string114.offset|=4161, |#t~string121.base|=4106, |#t~string121.offset|=4144, |#t~string211.base|=4166, |#t~string211.offset|=4109, |#t~string22.base|=4176, |#t~string22.offset|=4143, |#t~string237.base|=4115, |#t~string237.offset|=4138, |#t~string64.base|=4172, |#t~string64.offset|=4155, |#t~string65.base|=4153, |#t~string65.offset|=4180, |#t~string66.base|=4150, |#t~string66.offset|=4103, |#t~string84.base|=4158, |#t~string84.offset|=4112, |old(#NULL.base)|=4128, |old(#NULL.offset)|=4164, |old(#t~string114.base)|=4136, |old(#t~string114.offset)|=4161, |old(#t~string121.base)|=4106, |old(#t~string121.offset)|=4144, |old(#t~string211.base)|=4166, |old(#t~string211.offset)|=4109, |old(#t~string22.base)|=4176, |old(#t~string22.offset)|=4143, |old(#t~string237.base)|=4115, |old(#t~string237.offset)|=4138, |old(#t~string64.base)|=4172, |old(#t~string64.offset)|=4155, |old(#t~string65.base)|=4153, |old(#t~string65.offset)|=4180, |old(#t~string66.base)|=4150, |old(#t~string66.offset)|=4103, |old(#t~string84.base)|=4158, |old(#t~string84.offset)|=4112, |old(~#cp_table~0.base)|=4118, |old(~#cp_table~0.offset)|=4140, |old(~#ppp_header_ops~0.base)|=4131, |old(~#ppp_header_ops~0.offset)|=4126, |old(~#proto~0.base)|=4137, |old(~#proto~0.offset)|=4152, |old(~#set_impl~0.base)|=4168, |old(~#set_impl~0.offset)|=4123, |old(~#tx_queue~0.base)|=4159, |old(~#tx_queue~0.offset)|=4117, |old(~last_index~0)|=4160, |old(~LDV_IN_INTERRUPT~0)|=4120, |old(~ldv_retval_0~0)|=4116, |old(~LDV_SKBS~0.base)|=4104, |old(~LDV_SKBS~0.offset)|=4125, |old(~ldv_state_variable_0~0)|=4129, |old(~ldv_state_variable_1~0)|=4162, |old(~ldv_state_variable_2~0)|=4149, |old(~ldv_state_variable_3~0)|=4179, |old(~ldv_timer_list_1~0.base)|=4169, |old(~ldv_timer_list_1~0.offset)|=4170, |old(~ldv_timer_state_1~0)|=4177, |old(~proto_group0~0.base)|=4141, |old(~proto_group0~0.offset)|=4145, |old(~proto_group1~0.base)|=4122, |old(~proto_group1~0.offset)|=4134, |old(~ref_cnt~0)|=4147, |~#cp_table~0.base|=4118, |~#cp_table~0.offset|=4140, |~#ppp_header_ops~0.base|=4131, |~#ppp_header_ops~0.offset|=4126, |~#proto~0.base|=4137, |~#proto~0.offset|=4152, |~#set_impl~0.base|=4168, |~#set_impl~0.offset|=4123, |~#tx_queue~0.base|=4159, |~#tx_queue~0.offset|=4117, ~last_index~0=4160, ~LDV_IN_INTERRUPT~0=4120, ~ldv_retval_0~0=4116, ~LDV_SKBS~0.base=4104, ~LDV_SKBS~0.offset=4125, ~ldv_state_variable_0~0=4129, ~ldv_state_variable_1~0=4162, ~ldv_state_variable_2~0=4149, ~ldv_state_variable_3~0=4179, ~ldv_timer_list_1~0.base=4169, ~ldv_timer_list_1~0.offset=4170, ~ldv_timer_state_1~0=4177, ~proto_group0~0.base=4141, ~proto_group0~0.offset=4145, ~proto_group1~0.base=4122, ~proto_group1~0.offset=4134, ~ref_cnt~0=4147] [?] #NULL.base, #NULL.offset := 0, 0;#valid := #valid[0 := 0];call #t~string22.base, #t~string22.offset := #Ultimate.alloc(22);call #t~string64.base, #t~string64.offset := #Ultimate.alloc(4);call write~init~int(76, #t~string64.base, #t~string64.offset, 1);call write~init~int(67, #t~string64.base, 1 + #t~string64.offset, 1);call write~init~int(80, #t~string64.base, 2 + #t~string64.offset, 1);call write~init~int(0, #t~string64.base, 3 + #t~string64.offset, 1);call #t~string65.base, #t~string65.offset := #Ultimate.alloc(5);call write~init~int(73, #t~string65.base, #t~string65.offset, 1);call write~init~int(80, #t~string65.base, 1 + #t~string65.offset, 1);call write~init~int(67, #t~string65.base, 2 + #t~string65.offset, 1);call write~init~int(80, #t~string65.base, 3 + #t~string65.offset, 1);call write~init~int(0, #t~string65.base, 4 + #t~string65.offset, 1);call #t~string66.base, #t~string66.offset := #Ultimate.alloc(7);call write~init~int(73, #t~string66.base, #t~string66.offset, 1);call write~init~int(80, #t~string66.base, 1 + #t~string66.offset, 1);call write~init~int(86, #t~string66.base, 2 + #t~string66.offset, 1);call write~init~int(54, #t~string66.base, 3 + #t~string66.offset, 1);call write~init~int(67, #t~string66.base, 4 + #t~string66.offset, 1);call write~init~int(80, #t~string66.base, 5 + #t~string66.offset, 1);call write~init~int(0, #t~string66.base, 6 + #t~string66.offset, 1);call #t~string84.base, #t~string84.offset := #Ultimate.alloc(30);call #t~string114.base, #t~string114.offset := #Ultimate.alloc(7);call write~init~int(37, #t~string114.base, #t~string114.offset, 1);call write~init~int(115, #t~string114.base, 1 + #t~string114.offset, 1);call write~init~int(32, #t~string114.base, 2 + #t~string114.offset, 1);call write~init~int(117, #t~string114.base, 3 + #t~string114.offset, 1);call write~init~int(112, #t~string114.base, 4 + #t~string114.offset, 1);call write~init~int(10, #t~string114.base, 5 + #t~string114.offset, 1);call write~init~int(0, #t~string114.base, 6 + #t~string114.offset, 1);call #t~string121.base, #t~string121.offset := #Ultimate.alloc(9);call #t~string211.base, #t~string211.offset := #Ultimate.alloc(11);call #t~string237.base, #t~string237.offset := #Ultimate.alloc(21);~LDV_IN_INTERRUPT~0 := 1;~ldv_state_variable_0~0 := 0;~ldv_state_variable_3~0 := 0;~ldv_timer_state_1~0 := 0;~ldv_state_variable_2~0 := 0;~ref_cnt~0 := 0;~ldv_state_variable_1~0 := 0;call ~#cp_table~0.base, ~#cp_table~0.offset := #Ultimate.alloc(364);call write~init~int(163, ~#cp_table~0.base, ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 4 + ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 8 + ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 12 + ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 16 + ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 20 + ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 24 + ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 28 + ~#cp_table~0.offset, 4);call write~init~int(0, ~#cp_table~0.base, 32 + ~#cp_table~0.offset, 4);call write~init~int(0, ~#cp_table~0.base, 36 + ~#cp_table~0.offset, 4);call write~init~int(0, ~#cp_table~0.base, 40 + ~#cp_table~0.offset, 4);call write~init~int(0, ~#cp_table~0.base, 44 + ~#cp_table~0.offset, 4);call write~init~int(0, ~#cp_table~0.base, 48 + ~#cp_table~0.offset, 4);call write~init~int(0, ~#cp_table~0.base, 52 + ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 56 + ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 60 + ~#cp_table~0.offset, 4);call write~init~int(1026, ~#cp_table~0.base, 64 + ~#cp_table~0.offset, 4);call write~init~int(131, ~#cp_table~0.base, 68 + ~#cp_table~0.offset, 4);call write~init~int(131, ~#cp_table~0.base, 72 + ~#cp_table~0.offset, 4);call write~init~int(133, ~#cp_table~0.base, 76 + ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 80 + ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 84 + ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 88 + ~#cp_table~0.offset, 4);call write~init~int(1, ~#cp_table~0.base, 92 + ~#cp_table~0.offset, 4);call write~init~int(1, ~#cp_table~0.base, 96 + ~#cp_table~0.offset, 4);call write~init~int(1, ~#cp_table~0.base, 100 + ~#cp_table~0.offset, 4);call write~init~int(1, ~#cp_table~0.base, 104 + ~#cp_table~0.offset, 4);call write~init~int(16, ~#cp_table~0.base, 108 + ~#cp_table~0.offset, 4);call write~init~int(2048, ~#cp_table~0.base, 112 + ~#cp_table~0.offset, 4);call write~init~int(421, ~#cp_table~0.base, 116 + ~#cp_table~0.offset, 4);call write~init~int(2, ~#cp_table~0.base, 120 + ~#cp_table~0.offset, 4);call write~init~int(261, ~#cp_table~0.base, 124 + ~#cp_table~0.offset, 4);call write~init~int(262, ~#cp_table~0.base, 128 + ~#cp_table~0.offset, 4);call write~init~int(261, ~#cp_table~0.base, 132 + ~#cp_table~0.offset, 4);call write~init~int(389, ~#cp_table~0.base, 136 + ~#cp_table~0.offset, 4);call write~init~int(2048, ~#cp_table~0.base, 140 + ~#cp_table~0.offset, 4);call write~init~int(675, ~#cp_table~0.base, 144 + ~#cp_table~0.offset, 4);call write~init~int(2, ~#cp_table~0.base, 148 + ~#cp_table~0.offset, 4);call write~init~int(515, ~#cp_table~0.base, 152 + ~#cp_table~0.offset, 4);call write~init~int(516, ~#cp_table~0.base, 156 + ~#cp_table~0.offset, 4);call write~init~int(515, ~#cp_table~0.base, 160 + ~#cp_table~0.offset, 4);call write~init~int(643, ~#cp_table~0.base, 164 + ~#cp_table~0.offset, 4);call write~init~int(2048, ~#cp_table~0.base, 168 + ~#cp_table~0.offset, 4);call write~init~int(2049, ~#cp_table~0.base, 172 + ~#cp_table~0.offset, 4);call write~init~int(2, ~#cp_table~0.base, 176 + ~#cp_table~0.offset, 4);call write~init~int(36, ~#cp_table~0.base, 180 + ~#cp_table~0.offset, 4);call write~init~int(131, ~#cp_table~0.base, 184 + ~#cp_table~0.offset, 4);call write~init~int(6, ~#cp_table~0.base, 188 + ~#cp_table~0.offset, 4);call write~init~int(131, ~#cp_table~0.base, 192 + ~#cp_table~0.offset, 4);call write~init~int(2048, ~#cp_table~0.base, 196 + ~#cp_table~0.offset, 4);call write~init~int(2049, ~#cp_table~0.base, 200 + ~#cp_table~0.offset, 4);call write~init~int(2, ~#cp_table~0.base, 204 + ~#cp_table~0.offset, 4);call write~init~int(163, ~#cp_table~0.base, 208 + ~#cp_table~0.offset, 4);call write~init~int(131, ~#cp_table~0.base, 212 + ~#cp_table~0.offset, 4);call write~init~int(165, ~#cp_table~0.base, 216 + ~#cp_table~0.offset, 4);call write~init~int(131, ~#cp_table~0.base, 220 + ~#cp_table~0.offset, 4);call write~init~int(2048, ~#cp_table~0.base, 224 + ~#cp_table~0.offset, 4);call write~init~int(2049, ~#cp_table~0.base, 228 + ~#cp_table~0.offset, 4);call write~init~int(2050, ~#cp_table~0.base, 232 + ~#cp_table~0.offset, 4);call write~init~int(2051, ~#cp_table~0.base, 236 + ~#cp_table~0.offset, 4);call write~init~int(2051, ~#cp_table~0.base, 240 + ~#cp_table~0.offset, 4);call write~init~int(2051, ~#cp_table~0.base, 244 + ~#cp_table~0.offset, 4);call write~init~int(2114, ~#cp_table~0.base, 248 + ~#cp_table~0.offset, 4);call write~init~int(0, ~#cp_table~0.base, 252 + ~#cp_table~0.offset, 4);call write~init~int(1, ~#cp_table~0.base, 256 + ~#cp_table~0.offset, 4);call write~init~int(1, ~#cp_table~0.base, 260 + ~#cp_table~0.offset, 4);call write~init~int(3, ~#cp_table~0.base, 264 + ~#cp_table~0.offset, 4);call write~init~int(3, ~#cp_table~0.base, 268 + ~#cp_table~0.offset, 4);call write~init~int(5, ~#cp_table~0.base, 272 + ~#cp_table~0.offset, 4);call write~init~int(131, ~#cp_table~0.base, 276 + ~#cp_table~0.offset, 4);call write~init~int(4096, ~#cp_table~0.base, 280 + ~#cp_table~0.offset, 4);call write~init~int(4097, ~#cp_table~0.base, 284 + ~#cp_table~0.offset, 4);call write~init~int(4098, ~#cp_table~0.base, 288 + ~#cp_table~0.offset, 4);call write~init~int(4099, ~#cp_table~0.base, 292 + ~#cp_table~0.offset, 4);call write~init~int(4100, ~#cp_table~0.base, 296 + ~#cp_table~0.offset, 4);call write~init~int(4101, ~#cp_table~0.base, 300 + ~#cp_table~0.offset, 4);call write~init~int(4102, ~#cp_table~0.base, 304 + ~#cp_table~0.offset, 4);call write~init~int(0, ~#cp_table~0.base, 308 + ~#cp_table~0.offset, 4);call write~init~int(1, ~#cp_table~0.base, 312 + ~#cp_table~0.offset, 4);call write~init~int(2, ~#cp_table~0.base, 316 + ~#cp_table~0.offset, 4);call write~init~int(3, ~#cp_table~0.base, 320 + ~#cp_table~0.offset, 4);call write~init~int(3, ~#cp_table~0.base, 324 + ~#cp_table~0.offset, 4);call write~init~int(5, ~#cp_table~0.base, 328 + ~#cp_table~0.offset, 4);call write~init~int(6, ~#cp_table~0.base, 332 + ~#cp_table~0.offset, 4);call write~init~int(0, ~#cp_table~0.base, 336 + ~#cp_table~0.offset, 4);call write~init~int(1, ~#cp_table~0.base, 340 + ~#cp_table~0.offset, 4);call write~init~int(1, ~#cp_table~0.base, 344 + ~#cp_table~0.offset, 4);call write~init~int(1, ~#cp_table~0.base, 348 + ~#cp_table~0.offset, 4);call write~init~int(1, ~#cp_table~0.base, 352 + ~#cp_table~0.offset, 4);call write~init~int(1, ~#cp_table~0.base, 356 + ~#cp_table~0.offset, 4);call write~init~int(1058, ~#cp_table~0.base, 360 + ~#cp_table~0.offset, 4);~ldv_retval_0~0 := 0;~last_index~0 := 0;~proto_group1~0.base, ~proto_group1~0.offset := 0, 0;~proto_group0~0.base, ~proto_group0~0.offset := 0, 0;~ldv_timer_list_1~0.base, ~ldv_timer_list_1~0.offset := 0, 0;call ~#tx_queue~0.base, ~#tx_queue~0.offset := #Ultimate.alloc(88);call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, ~#tx_queue~0.offset, 8);call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 8 + ~#tx_queue~0.offset, 8);call write~init~int(0, ~#tx_queue~0.base, 16 + ~#tx_queue~0.offset, 4);call write~init~int(0, ~#tx_queue~0.base, 20 + ~#tx_queue~0.offset, 4);call write~init~int(0, ~#tx_queue~0.base, 24 + ~#tx_queue~0.offset, 4);call write~init~int(0, ~#tx_queue~0.base, 28 + ~#tx_queue~0.offset, 4);call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 32 + ~#tx_queue~0.offset, 8);call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 40 + ~#tx_queue~0.offset, 8);call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 48 + ~#tx_queue~0.offset, 8);call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 56 + ~#tx_queue~0.offset, 8);call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 64 + ~#tx_queue~0.offset, 8);call write~init~int(0, ~#tx_queue~0.base, 72 + ~#tx_queue~0.offset, 4);call write~init~int(0, ~#tx_queue~0.base, 76 + ~#tx_queue~0.offset, 8);call ~#proto~0.base, ~#proto~0.offset := #Ultimate.alloc(88);call write~init~$Pointer$(0, 0, ~#proto~0.base, ~#proto~0.offset, 8);call write~init~$Pointer$(#funAddr~ppp_close.base, #funAddr~ppp_close.offset, ~#proto~0.base, 8 + ~#proto~0.offset, 8);call write~init~$Pointer$(#funAddr~ppp_start.base, #funAddr~ppp_start.offset, ~#proto~0.base, 16 + ~#proto~0.offset, 8);call write~init~$Pointer$(#funAddr~ppp_stop.base, #funAddr~ppp_stop.offset, ~#proto~0.base, 24 + ~#proto~0.offset, 8);call write~init~$Pointer$(0, 0, ~#proto~0.base, 32 + ~#proto~0.offset, 8);call write~init~$Pointer$(#funAddr~ppp_ioctl.base, #funAddr~ppp_ioctl.offset, ~#proto~0.base, 40 + ~#proto~0.offset, 8);call write~init~$Pointer$(#funAddr~ppp_type_trans.base, #funAddr~ppp_type_trans.offset, ~#proto~0.base, 48 + ~#proto~0.offset, 8);call write~init~$Pointer$(#funAddr~ppp_rx.base, #funAddr~ppp_rx.offset, ~#proto~0.base, 56 + ~#proto~0.offset, 8);call write~init~$Pointer$(0, 0, ~#proto~0.base, 64 + ~#proto~0.offset, 8);call write~init~$Pointer$(~#__this_module~0.base, ~#__this_module~0.offset, ~#proto~0.base, 72 + ~#proto~0.offset, 8);call write~init~$Pointer$(0, 0, ~#proto~0.base, 80 + ~#proto~0.offset, 8);call ~#ppp_header_ops~0.base, ~#ppp_header_ops~0.offset := #Ultimate.alloc(40);call write~init~$Pointer$(#funAddr~ppp_hard_header.base, #funAddr~ppp_hard_header.offset, ~#ppp_header_ops~0.base, ~#ppp_header_ops~0.offset, 8);call write~init~$Pointer$(0, 0, ~#ppp_header_ops~0.base, 8 + ~#ppp_header_ops~0.offset, 8);call write~init~$Pointer$(0, 0, ~#ppp_header_ops~0.base, 16 + ~#ppp_header_ops~0.offset, 8);call write~init~$Pointer$(0, 0, ~#ppp_header_ops~0.base, 24 + ~#ppp_header_ops~0.offset, 8);call write~init~$Pointer$(0, 0, ~#ppp_header_ops~0.base, 32 + ~#ppp_header_ops~0.offset, 8);call ~#set_impl~0.base, ~#set_impl~0.offset := #Ultimate.alloc(120);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 8 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 16 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 24 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 32 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 40 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 48 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 56 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 64 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 72 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 80 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 88 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 96 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 104 + ~#set_impl~0.offset, 8);call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 112 + ~#set_impl~0.offset, 8);~LDV_SKBS~0.base, ~LDV_SKBS~0.offset := 0, 0; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(#NULL.base)|=4128, |old(#NULL.offset)|=4164, |old(#t~string114.base)|=4136, |old(#t~string114.offset)|=4161, |old(#t~string121.base)|=4106, |old(#t~string121.offset)|=4144, |old(#t~string211.base)|=4166, |old(#t~string211.offset)|=4109, |old(#t~string22.base)|=4176, |old(#t~string22.offset)|=4143, |old(#t~string237.base)|=4115, |old(#t~string237.offset)|=4138, |old(#t~string64.base)|=4172, |old(#t~string64.offset)|=4155, |old(#t~string65.base)|=4153, |old(#t~string65.offset)|=4180, |old(#t~string66.base)|=4150, |old(#t~string66.offset)|=4103, |old(#t~string84.base)|=4158, |old(#t~string84.offset)|=4112, |old(~#cp_table~0.base)|=4118, |old(~#cp_table~0.offset)|=4140, |old(~#ppp_header_ops~0.base)|=4131, |old(~#ppp_header_ops~0.offset)|=4126, |old(~#proto~0.base)|=4137, |old(~#proto~0.offset)|=4152, |old(~#set_impl~0.base)|=4168, |old(~#set_impl~0.offset)|=4123, |old(~#tx_queue~0.base)|=4159, |old(~#tx_queue~0.offset)|=4117, |old(~last_index~0)|=4160, |old(~LDV_IN_INTERRUPT~0)|=4120, |old(~ldv_retval_0~0)|=4116, |old(~LDV_SKBS~0.base)|=4104, |old(~LDV_SKBS~0.offset)|=4125, |old(~ldv_state_variable_0~0)|=4129, |old(~ldv_state_variable_1~0)|=4162, |old(~ldv_state_variable_2~0)|=4149, |old(~ldv_state_variable_3~0)|=4179, |old(~ldv_timer_list_1~0.base)|=4169, |old(~ldv_timer_list_1~0.offset)|=4170, |old(~ldv_timer_state_1~0)|=4177, |old(~proto_group0~0.base)|=4141, |old(~proto_group0~0.offset)|=4145, |old(~proto_group1~0.base)|=4122, |old(~proto_group1~0.offset)|=4134, |old(~ref_cnt~0)|=4147, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(#NULL.base)|=4128, |old(#NULL.offset)|=4164, |old(#t~string114.base)|=4136, |old(#t~string114.offset)|=4161, |old(#t~string121.base)|=4106, |old(#t~string121.offset)|=4144, |old(#t~string211.base)|=4166, |old(#t~string211.offset)|=4109, |old(#t~string22.base)|=4176, |old(#t~string22.offset)|=4143, |old(#t~string237.base)|=4115, |old(#t~string237.offset)|=4138, |old(#t~string64.base)|=4172, |old(#t~string64.offset)|=4155, |old(#t~string65.base)|=4153, |old(#t~string65.offset)|=4180, |old(#t~string66.base)|=4150, |old(#t~string66.offset)|=4103, |old(#t~string84.base)|=4158, |old(#t~string84.offset)|=4112, |old(~#cp_table~0.base)|=4118, |old(~#cp_table~0.offset)|=4140, |old(~#ppp_header_ops~0.base)|=4131, |old(~#ppp_header_ops~0.offset)|=4126, |old(~#proto~0.base)|=4137, |old(~#proto~0.offset)|=4152, |old(~#set_impl~0.base)|=4168, |old(~#set_impl~0.offset)|=4123, |old(~#tx_queue~0.base)|=4159, |old(~#tx_queue~0.offset)|=4117, |old(~last_index~0)|=4160, |old(~LDV_IN_INTERRUPT~0)|=4120, |old(~ldv_retval_0~0)|=4116, |old(~LDV_SKBS~0.base)|=4104, |old(~LDV_SKBS~0.offset)|=4125, |old(~ldv_state_variable_0~0)|=4129, |old(~ldv_state_variable_1~0)|=4162, |old(~ldv_state_variable_2~0)|=4149, |old(~ldv_state_variable_3~0)|=4179, |old(~ldv_timer_list_1~0.base)|=4169, |old(~ldv_timer_list_1~0.offset)|=4170, |old(~ldv_timer_state_1~0)|=4177, |old(~proto_group0~0.base)|=4141, |old(~proto_group0~0.offset)|=4145, |old(~proto_group1~0.base)|=4122, |old(~proto_group1~0.offset)|=4134, |old(~ref_cnt~0)|=4147, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1649#return; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret298 := main(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] havoc ~ldvarg0~0.base, ~ldvarg0~0.offset;havoc ~tmp~20.base, ~tmp~20.offset;havoc ~ldvarg1~0;havoc ~tmp___0~9;havoc ~ldvarg4~0;havoc ~tmp___1~3;havoc ~ldvarg3~0.base, ~ldvarg3~0.offset;havoc ~tmp___2~5.base, ~tmp___2~5.offset;havoc ~ldvarg5~0.base, ~ldvarg5~0.offset;havoc ~tmp___3~2.base, ~tmp___3~2.offset;havoc ~ldvarg2~0.base, ~ldvarg2~0.offset;havoc ~tmp___4~3.base, ~tmp___4~3.offset;havoc ~ldvarg6~0.base, ~ldvarg6~0.offset;havoc ~tmp___5~1.base, ~tmp___5~1.offset;havoc ~tmp___6~1;havoc ~tmp___7~1;havoc ~tmp___8~0;havoc ~tmp___9~0; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret245.base, #t~ret245.offset := ldv_zalloc(40); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=40, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~size := #in~size;havoc ~p~1.base, ~p~1.offset;havoc ~tmp~2.base, ~tmp~2.offset;havoc ~tmp___0~1;assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647;~tmp___0~1 := #t~nondet38;havoc #t~nondet38; VAL [ldv_zalloc_~size=40, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=40, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 != ~tmp___0~1;#res.base, #res.offset := 0, 0; VAL [ldv_zalloc_~size=40, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=40, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_zalloc_~size=40, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=40, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1427#return; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~ret245.base|=0, |main_#t~ret245.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp~20.base, ~tmp~20.offset := #t~ret245.base, #t~ret245.offset;havoc #t~ret245.base, #t~ret245.offset;~ldvarg0~0.base, ~ldvarg0~0.offset := ~tmp~20.base, ~tmp~20.offset;~tmp___0~9 := #t~nondet246;havoc #t~nondet246;~ldvarg1~0 := ~tmp___0~9;~tmp___1~3 := #t~nondet247;havoc #t~nondet247;~ldvarg4~0 := ~tmp___1~3; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg4~0=4173, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret248.base, #t~ret248.offset := ldv_zalloc(232); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=232, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~size := #in~size;havoc ~p~1.base, ~p~1.offset;havoc ~tmp~2.base, ~tmp~2.offset;havoc ~tmp___0~1;assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647;~tmp___0~1 := #t~nondet38;havoc #t~nondet38; VAL [ldv_zalloc_~size=232, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=232, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 != ~tmp___0~1;#res.base, #res.offset := 0, 0; VAL [ldv_zalloc_~size=232, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=232, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_zalloc_~size=232, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=232, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1429#return; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg4~0=4173, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~ret248.base|=0, |main_#t~ret248.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp___2~5.base, ~tmp___2~5.offset := #t~ret248.base, #t~ret248.offset;havoc #t~ret248.base, #t~ret248.offset;~ldvarg3~0.base, ~ldvarg3~0.offset := ~tmp___2~5.base, ~tmp___2~5.offset; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret249.base, #t~ret249.offset := ldv_zalloc(3264); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=3264, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~size := #in~size;havoc ~p~1.base, ~p~1.offset;havoc ~tmp~2.base, ~tmp~2.offset;havoc ~tmp___0~1;assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647;~tmp___0~1 := #t~nondet38;havoc #t~nondet38; VAL [ldv_zalloc_~size=3264, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=3264, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 != ~tmp___0~1;#res.base, #res.offset := 0, 0; VAL [ldv_zalloc_~size=3264, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=3264, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_zalloc_~size=3264, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=3264, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1431#return; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~ret249.base|=0, |main_#t~ret249.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp___3~2.base, ~tmp___3~2.offset := #t~ret249.base, #t~ret249.offset;havoc #t~ret249.base, #t~ret249.offset;~ldvarg5~0.base, ~ldvarg5~0.offset := ~tmp___3~2.base, ~tmp___3~2.offset; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret250.base, #t~ret250.offset := ldv_zalloc(1); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=1, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~size := #in~size;havoc ~p~1.base, ~p~1.offset;havoc ~tmp~2.base, ~tmp~2.offset;havoc ~tmp___0~1;assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647;~tmp___0~1 := #t~nondet38;havoc #t~nondet38; VAL [ldv_zalloc_~size=1, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=1, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 != ~tmp___0~1;#res.base, #res.offset := 0, 0; VAL [ldv_zalloc_~size=1, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=1, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_zalloc_~size=1, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=1, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1433#return; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~ret250.base|=0, |main_#t~ret250.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp___4~3.base, ~tmp___4~3.offset := #t~ret250.base, #t~ret250.offset;havoc #t~ret250.base, #t~ret250.offset;~ldvarg2~0.base, ~ldvarg2~0.offset := ~tmp___4~3.base, ~tmp___4~3.offset; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret251.base, #t~ret251.offset := ldv_zalloc(1); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=1, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~size := #in~size;havoc ~p~1.base, ~p~1.offset;havoc ~tmp~2.base, ~tmp~2.offset;havoc ~tmp___0~1;assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647;~tmp___0~1 := #t~nondet38;havoc #t~nondet38; VAL [ldv_zalloc_~size=1, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=1, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 != ~tmp___0~1;#res.base, #res.offset := 0, 0; VAL [ldv_zalloc_~size=1, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=1, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_zalloc_~size=1, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=1, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1435#return; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~ret251.base|=0, |main_#t~ret251.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp___5~1.base, ~tmp___5~1.offset := #t~ret251.base, #t~ret251.offset;havoc #t~ret251.base, #t~ret251.offset;~ldvarg6~0.base, ~ldvarg6~0.offset := ~tmp___5~1.base, ~tmp___5~1.offset; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call ldv_initialize(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call ldv_set_init(~LDV_SKBS~0.base, ~LDV_SKBS~0.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_set_init_#in~set.base|=0, |ldv_set_init_#in~set.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~set.base, ~set.offset := #in~set.base, #in~set.offset;~set.base, ~set.offset := ~#set_impl~0.base, ~#set_impl~0.offset;~last_index~0 := 0; VAL [ldv_set_init_~set.base=4156, ldv_set_init_~set.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_set_init_#in~set.base|=0, |ldv_set_init_#in~set.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_set_init_~set.base=4156, ldv_set_init_~set.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_set_init_#in~set.base|=0, |ldv_set_init_#in~set.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1503#return; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1437#return; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~ldv_state_variable_1~0 := 1;~ref_cnt~0 := 0;~ldv_state_variable_0~0 := 1;~ldv_state_variable_3~0 := 0;~ldv_state_variable_2~0 := 0; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume -2147483648 <= #t~nondet252 && #t~nondet252 <= 2147483647;~tmp___6~1 := #t~nondet252;havoc #t~nondet252;#t~switch253 := 0 == ~tmp___6~1; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=false, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !#t~switch253;#t~switch253 := #t~switch253 || 1 == ~tmp___6~1; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume #t~switch253; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 != ~ldv_state_variable_0~0;assume -2147483648 <= #t~nondet254 && #t~nondet254 <= 2147483647;~tmp___7~1 := #t~nondet254;havoc #t~nondet254;#t~switch255 := 0 == ~tmp___7~1; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=false, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !#t~switch255;#t~switch255 := #t~switch255 || 1 == ~tmp___7~1; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume #t~switch255; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 1 == ~ldv_state_variable_0~0; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret256 := mod_init(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call skb_queue_head_init(~#tx_queue~0.base, ~#tx_queue~0.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |skb_queue_head_init_#in~list.base|=4146, |skb_queue_head_init_#in~list.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~list.base, ~list.offset := #in~list.base, #in~list.offset;call ~#__key~0.base, ~#__key~0.offset := #Ultimate.alloc(8); VAL [skb_queue_head_init_~list.base=4146, skb_queue_head_init_~list.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |skb_queue_head_init_#in~list.base|=4146, |skb_queue_head_init_#in~list.offset|=0, |skb_queue_head_init_~#__key~0.base|=4167, |skb_queue_head_init_~#__key~0.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret21.base, #t~ret21.offset := spinlock_check(~list.base, 20 + ~list.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |spinlock_check_#in~lock.base|=4146, |spinlock_check_#in~lock.offset|=20, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~lock.base, ~lock.offset := #in~lock.base, #in~lock.offset;#res.base, #res.offset := ~lock.base, ~lock.offset; VAL [spinlock_check_~lock.base=4146, spinlock_check_~lock.offset=20, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |spinlock_check_#in~lock.base|=4146, |spinlock_check_#in~lock.offset|=20, |spinlock_check_#res.base|=4146, |spinlock_check_#res.offset|=20, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [spinlock_check_~lock.base=4146, spinlock_check_~lock.offset=20, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |spinlock_check_#in~lock.base|=4146, |spinlock_check_#in~lock.offset|=20, |spinlock_check_#res.base|=4146, |spinlock_check_#res.offset|=20, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1521#return; VAL [skb_queue_head_init_~list.base=4146, skb_queue_head_init_~list.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |skb_queue_head_init_#in~list.base|=4146, |skb_queue_head_init_#in~list.offset|=0, |skb_queue_head_init_#t~ret21.base|=4146, |skb_queue_head_init_#t~ret21.offset|=20, |skb_queue_head_init_~#__key~0.base|=4167, |skb_queue_head_init_~#__key~0.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] havoc #t~ret21.base, #t~ret21.offset;call __raw_spin_lock_init(~list.base, 20 + ~list.offset, #t~string22.base, #t~string22.offset, ~#__key~0.base, ~#__key~0.offset); VAL [skb_queue_head_init_~list.base=4146, skb_queue_head_init_~list.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |skb_queue_head_init_#in~list.base|=4146, |skb_queue_head_init_#in~list.offset|=0, |skb_queue_head_init_~#__key~0.base|=4167, |skb_queue_head_init_~#__key~0.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call __skb_queue_head_init(~list.base, ~list.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |__skb_queue_head_init_#in~list.base|=4146, |__skb_queue_head_init_#in~list.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~list.base, ~list.offset := #in~list.base, #in~list.offset;havoc ~tmp~0.base, ~tmp~0.offset;~tmp~0.base, ~tmp~0.offset := ~list.base, ~list.offset;call write~$Pointer$(~tmp~0.base, ~tmp~0.offset, ~list.base, ~list.offset, 8);call write~$Pointer$(~tmp~0.base, ~tmp~0.offset, ~list.base, 8 + ~list.offset, 8);call write~int(0, ~list.base, 16 + ~list.offset, 4); VAL [__skb_queue_head_init_~list.base=4146, __skb_queue_head_init_~list.offset=0, __skb_queue_head_init_~tmp~0.base=4146, __skb_queue_head_init_~tmp~0.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |__skb_queue_head_init_#in~list.base|=4146, |__skb_queue_head_init_#in~list.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [__skb_queue_head_init_~list.base=4146, __skb_queue_head_init_~list.offset=0, __skb_queue_head_init_~tmp~0.base=4146, __skb_queue_head_init_~tmp~0.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |__skb_queue_head_init_#in~list.base|=4146, |__skb_queue_head_init_#in~list.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1523#return; VAL [skb_queue_head_init_~list.base=4146, skb_queue_head_init_~list.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |skb_queue_head_init_#in~list.base|=4146, |skb_queue_head_init_#in~list.offset|=0, |skb_queue_head_init_~#__key~0.base|=4167, |skb_queue_head_init_~#__key~0.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] call ULTIMATE.dealloc(~#__key~0.base, ~#__key~0.offset);havoc ~#__key~0.base, ~#__key~0.offset; VAL [skb_queue_head_init_~list.base=4146, skb_queue_head_init_~list.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |skb_queue_head_init_#in~list.base|=4146, |skb_queue_head_init_#in~list.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [skb_queue_head_init_~list.base=4146, skb_queue_head_init_~list.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |skb_queue_head_init_#in~list.base|=4146, |skb_queue_head_init_#in~list.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1641#return; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] call register_hdlc_protocol(~#proto~0.base, ~#proto~0.offset);#res := 0; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |mod_init_#res|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |mod_init_#res|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1443#return; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~ret256|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume -2147483648 <= #t~ret256 && #t~ret256 <= 2147483647;~ldv_retval_0~0 := #t~ret256;havoc #t~ret256; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 == ~ldv_retval_0~0;~ldv_state_variable_0~0 := 3;~ldv_state_variable_2~0 := 1;~ldv_state_variable_3~0 := 1; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call ldv_initialize_hdlc_proto_3(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] havoc ~tmp~19.base, ~tmp~19.offset;havoc ~tmp___0~8.base, ~tmp___0~8.offset; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret239.base, #t~ret239.offset := ldv_zalloc(3264); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=3264, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~size := #in~size;havoc ~p~1.base, ~p~1.offset;havoc ~tmp~2.base, ~tmp~2.offset;havoc ~tmp___0~1;assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647;~tmp___0~1 := #t~nondet38;havoc #t~nondet38; VAL [ldv_zalloc_~size=3264, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=3264, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 != ~tmp___0~1;#res.base, #res.offset := 0, 0; VAL [ldv_zalloc_~size=3264, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=3264, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_zalloc_~size=3264, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=3264, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1603#return; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_initialize_hdlc_proto_3_#t~ret239.base|=0, |ldv_initialize_hdlc_proto_3_#t~ret239.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp~19.base, ~tmp~19.offset := #t~ret239.base, #t~ret239.offset;havoc #t~ret239.base, #t~ret239.offset;~proto_group1~0.base, ~proto_group1~0.offset := ~tmp~19.base, ~tmp~19.offset; VAL [ldv_initialize_hdlc_proto_3_~tmp~19.base=0, ldv_initialize_hdlc_proto_3_~tmp~19.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret240.base, #t~ret240.offset := ldv_zalloc(232); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=232, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~size := #in~size;havoc ~p~1.base, ~p~1.offset;havoc ~tmp~2.base, ~tmp~2.offset;havoc ~tmp___0~1;assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647;~tmp___0~1 := #t~nondet38;havoc #t~nondet38; VAL [ldv_zalloc_~size=232, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=232, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 != ~tmp___0~1;#res.base, #res.offset := 0, 0; VAL [ldv_zalloc_~size=232, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=232, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_zalloc_~size=232, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=232, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1605#return; VAL [ldv_initialize_hdlc_proto_3_~tmp~19.base=0, ldv_initialize_hdlc_proto_3_~tmp~19.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_initialize_hdlc_proto_3_#t~ret240.base|=0, |ldv_initialize_hdlc_proto_3_#t~ret240.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp___0~8.base, ~tmp___0~8.offset := #t~ret240.base, #t~ret240.offset;havoc #t~ret240.base, #t~ret240.offset;~proto_group0~0.base, ~proto_group0~0.offset := ~tmp___0~8.base, ~tmp___0~8.offset; VAL [ldv_initialize_hdlc_proto_3_~tmp___0~8.base=0, ldv_initialize_hdlc_proto_3_~tmp___0~8.offset=0, ldv_initialize_hdlc_proto_3_~tmp~19.base=0, ldv_initialize_hdlc_proto_3_~tmp~19.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_initialize_hdlc_proto_3_~tmp___0~8.base=0, ldv_initialize_hdlc_proto_3_~tmp___0~8.offset=0, ldv_initialize_hdlc_proto_3_~tmp~19.base=0, ldv_initialize_hdlc_proto_3_~tmp~19.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1445#return; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !(0 != ~ldv_retval_0~0); VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume -2147483648 <= #t~nondet252 && #t~nondet252 <= 2147483647;~tmp___6~1 := #t~nondet252;havoc #t~nondet252;#t~switch253 := 0 == ~tmp___6~1; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=false, |main_#t~switch255|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !#t~switch253;#t~switch253 := #t~switch253 || 1 == ~tmp___6~1; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=false, |main_#t~switch255|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !#t~switch253;#t~switch253 := #t~switch253 || 2 == ~tmp___6~1; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume #t~switch253; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 != ~ldv_state_variable_3~0;assume -2147483648 <= #t~nondet257 && #t~nondet257 <= 2147483647;~tmp___8~0 := #t~nondet257;havoc #t~nondet257;#t~switch258 := 0 == ~tmp___8~0; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=false, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !#t~switch258;#t~switch258 := #t~switch258 || 1 == ~tmp___8~0; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=false, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !#t~switch258;#t~switch258 := #t~switch258 || 2 == ~tmp___8~0; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=false, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !#t~switch258;#t~switch258 := #t~switch258 || 3 == ~tmp___8~0; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=false, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !#t~switch258;#t~switch258 := #t~switch258 || 4 == ~tmp___8~0; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume #t~switch258; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !(4 == ~ldv_state_variable_3~0); VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 1 == ~ldv_state_variable_3~0; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret270 := ppp_rx(~proto_group0~0.base, ~proto_group0~0.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~skb.base, ~skb.offset := #in~skb.base, #in~skb.offset;havoc ~hdr~0.base, ~hdr~0.offset;havoc ~dev~0.base, ~dev~0.offset;havoc ~ppp~2.base, ~ppp~2.offset;havoc ~tmp~15.base, ~tmp~15.offset;havoc ~proto___0~1.base, ~proto___0~1.offset;havoc ~cp~1.base, ~cp~1.offset;havoc ~flags~0;havoc ~len~1;havoc ~pid~0;havoc ~tmp___0~5.base, ~tmp___0~5.offset;havoc ~tmp___1~1.base, ~tmp___1~1.offset;havoc ~tmp___2~3;havoc ~tmp___3~1;havoc ~tmp___4~2;call #t~mem149.base, #t~mem149.offset := read~$Pointer$(~skb.base, 232 + ~skb.offset, 8);~hdr~0.base, ~hdr~0.offset := #t~mem149.base, #t~mem149.offset;havoc #t~mem149.base, #t~mem149.offset;call #t~mem150.base, #t~mem150.offset := read~$Pointer$(~skb.base, 32 + ~skb.offset, 8);~dev~0.base, ~dev~0.offset := #t~mem150.base, #t~mem150.offset;havoc #t~mem150.base, #t~mem150.offset; VAL [ppp_rx_~dev~0.base=4113, ppp_rx_~dev~0.offset=(- 3264), ppp_rx_~hdr~0.base=4127, ppp_rx_~hdr~0.offset=4157, ppp_rx_~skb.base=0, ppp_rx_~skb.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret151.base, #t~ret151.offset := get_ppp(~dev~0.base, ~dev~0.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |get_ppp_#in~dev.base|=4113, |get_ppp_#in~dev.offset|=(- 3264), |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~dev.base, ~dev.offset := #in~dev.base, #in~dev.offset;havoc ~tmp~9.base, ~tmp~9.offset; VAL [get_ppp_~dev.base=4113, get_ppp_~dev.offset=(- 3264), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |get_ppp_#in~dev.base|=4113, |get_ppp_#in~dev.offset|=(- 3264), |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret59.base, #t~ret59.offset := dev_to_hdlc(~dev.base, ~dev.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |dev_to_hdlc_#in~dev.base|=4113, |dev_to_hdlc_#in~dev.offset|=(- 3264), |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~dev.base, ~dev.offset := #in~dev.base, #in~dev.offset;havoc ~tmp~8.base, ~tmp~8.offset; VAL [dev_to_hdlc_~dev.base=4113, dev_to_hdlc_~dev.offset=(- 3264), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |dev_to_hdlc_#in~dev.base|=4113, |dev_to_hdlc_#in~dev.offset|=(- 3264), |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret55.base, #t~ret55.offset := netdev_priv(~dev.base, ~dev.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |netdev_priv_#in~dev.base|=4113, |netdev_priv_#in~dev.offset|=(- 3264), |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~dev.base, ~dev.offset := #in~dev.base, #in~dev.offset;#res.base, #res.offset := ~dev.base, 3264 + ~dev.offset; VAL [netdev_priv_~dev.base=4113, netdev_priv_~dev.offset=(- 3264), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |netdev_priv_#in~dev.base|=4113, |netdev_priv_#in~dev.offset|=(- 3264), |netdev_priv_#res.base|=4113, |netdev_priv_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [netdev_priv_~dev.base=4113, netdev_priv_~dev.offset=(- 3264), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |netdev_priv_#in~dev.base|=4113, |netdev_priv_#in~dev.offset|=(- 3264), |netdev_priv_#res.base|=4113, |netdev_priv_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1525#return; VAL [dev_to_hdlc_~dev.base=4113, dev_to_hdlc_~dev.offset=(- 3264), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |dev_to_hdlc_#in~dev.base|=4113, |dev_to_hdlc_#in~dev.offset|=(- 3264), |dev_to_hdlc_#t~ret55.base|=4113, |dev_to_hdlc_#t~ret55.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp~8.base, ~tmp~8.offset := #t~ret55.base, #t~ret55.offset;havoc #t~ret55.base, #t~ret55.offset;#res.base, #res.offset := ~tmp~8.base, ~tmp~8.offset; VAL [dev_to_hdlc_~dev.base=4113, dev_to_hdlc_~dev.offset=(- 3264), dev_to_hdlc_~tmp~8.base=4113, dev_to_hdlc_~tmp~8.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |dev_to_hdlc_#in~dev.base|=4113, |dev_to_hdlc_#in~dev.offset|=(- 3264), |dev_to_hdlc_#res.base|=4113, |dev_to_hdlc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [dev_to_hdlc_~dev.base=4113, dev_to_hdlc_~dev.offset=(- 3264), dev_to_hdlc_~tmp~8.base=4113, dev_to_hdlc_~tmp~8.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |dev_to_hdlc_#in~dev.base|=4113, |dev_to_hdlc_#in~dev.offset|=(- 3264), |dev_to_hdlc_#res.base|=4113, |dev_to_hdlc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1495#return; VAL [get_ppp_~dev.base=4113, get_ppp_~dev.offset=(- 3264), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |get_ppp_#in~dev.base|=4113, |get_ppp_#in~dev.offset|=(- 3264), |get_ppp_#t~ret59.base|=4113, |get_ppp_#t~ret59.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp~9.base, ~tmp~9.offset := #t~ret59.base, #t~ret59.offset;havoc #t~ret59.base, #t~ret59.offset;call #t~mem60.base, #t~mem60.offset := read~$Pointer$(~tmp~9.base, 100 + ~tmp~9.offset, 8);#res.base, #res.offset := #t~mem60.base, #t~mem60.offset;havoc #t~mem60.base, #t~mem60.offset; VAL [get_ppp_~dev.base=4113, get_ppp_~dev.offset=(- 3264), get_ppp_~tmp~9.base=4113, get_ppp_~tmp~9.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |get_ppp_#in~dev.base|=4113, |get_ppp_#in~dev.offset|=(- 3264), |get_ppp_#res.base|=4174, |get_ppp_#res.offset|=(- 435), |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [get_ppp_~dev.base=4113, get_ppp_~dev.offset=(- 3264), get_ppp_~tmp~9.base=4113, get_ppp_~tmp~9.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |get_ppp_#in~dev.base|=4113, |get_ppp_#in~dev.offset|=(- 3264), |get_ppp_#res.base|=4174, |get_ppp_#res.offset|=(- 435), |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1387#return; VAL [ppp_rx_~dev~0.base=4113, ppp_rx_~dev~0.offset=(- 3264), ppp_rx_~hdr~0.base=4127, ppp_rx_~hdr~0.offset=4157, ppp_rx_~skb.base=0, ppp_rx_~skb.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |ppp_rx_#t~ret151.base|=4174, |ppp_rx_#t~ret151.offset|=(- 435), |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp~15.base, ~tmp~15.offset := #t~ret151.base, #t~ret151.offset;havoc #t~ret151.base, #t~ret151.offset;~ppp~2.base, ~ppp~2.offset := ~tmp~15.base, ~tmp~15.offset; VAL [ppp_rx_~dev~0.base=4113, ppp_rx_~dev~0.offset=(- 3264), ppp_rx_~hdr~0.base=4127, ppp_rx_~hdr~0.offset=4157, ppp_rx_~ppp~2.base=4174, ppp_rx_~ppp~2.offset=(- 435), ppp_rx_~skb.base=0, ppp_rx_~skb.offset=0, ppp_rx_~tmp~15.base=4174, ppp_rx_~tmp~15.offset=(- 435), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret152.base, #t~ret152.offset := spinlock_check(~ppp~2.base, 435 + ~ppp~2.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |spinlock_check_#in~lock.base|=4174, |spinlock_check_#in~lock.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~lock.base, ~lock.offset := #in~lock.base, #in~lock.offset;#res.base, #res.offset := ~lock.base, ~lock.offset; VAL [spinlock_check_~lock.base=4174, spinlock_check_~lock.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |spinlock_check_#in~lock.base|=4174, |spinlock_check_#in~lock.offset|=0, |spinlock_check_#res.base|=4174, |spinlock_check_#res.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [spinlock_check_~lock.base=4174, spinlock_check_~lock.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |spinlock_check_#in~lock.base|=4174, |spinlock_check_#in~lock.offset|=0, |spinlock_check_#res.base|=4174, |spinlock_check_#res.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1389#return; VAL [ppp_rx_~dev~0.base=4113, ppp_rx_~dev~0.offset=(- 3264), ppp_rx_~hdr~0.base=4127, ppp_rx_~hdr~0.offset=4157, ppp_rx_~ppp~2.base=4174, ppp_rx_~ppp~2.offset=(- 435), ppp_rx_~skb.base=0, ppp_rx_~skb.offset=0, ppp_rx_~tmp~15.base=4174, ppp_rx_~tmp~15.offset=(- 435), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |ppp_rx_#t~ret152.base|=4174, |ppp_rx_#t~ret152.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp___0~5.base, ~tmp___0~5.offset := #t~ret152.base, #t~ret152.offset;havoc #t~ret152.base, #t~ret152.offset;call #t~ret153 := _raw_spin_lock_irqsave(~tmp___0~5.base, ~tmp___0~5.offset);~flags~0 := #t~ret153;havoc #t~ret153;call #t~mem154 := read~int(~skb.base, 104 + ~skb.offset, 4); VAL [ppp_rx_~dev~0.base=4113, ppp_rx_~dev~0.offset=(- 3264), ppp_rx_~hdr~0.base=4127, ppp_rx_~hdr~0.offset=4157, ppp_rx_~ppp~2.base=4174, ppp_rx_~ppp~2.offset=(- 435), ppp_rx_~skb.base=0, ppp_rx_~skb.offset=0, ppp_rx_~tmp___0~5.base=4174, ppp_rx_~tmp___0~5.offset=0, ppp_rx_~tmp~15.base=4174, ppp_rx_~tmp~15.offset=(- 435), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |ppp_rx_#t~mem154|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume #t~mem154 % 4294967296 <= 3;havoc #t~mem154; VAL [ppp_rx_~dev~0.base=4113, ppp_rx_~dev~0.offset=(- 3264), ppp_rx_~hdr~0.base=4127, ppp_rx_~hdr~0.offset=4157, ppp_rx_~ppp~2.base=4174, ppp_rx_~ppp~2.offset=(- 435), ppp_rx_~skb.base=0, ppp_rx_~skb.offset=0, ppp_rx_~tmp___0~5.base=4174, ppp_rx_~tmp___0~5.offset=0, ppp_rx_~tmp~15.base=4174, ppp_rx_~tmp~15.offset=(- 435), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] call #t~mem193 := read~int(~dev~0.base, 292 + ~dev~0.offset, 8);call write~int(1 + #t~mem193, ~dev~0.base, 292 + ~dev~0.offset, 8);havoc #t~mem193; VAL [ppp_rx_~dev~0.base=4113, ppp_rx_~dev~0.offset=(- 3264), ppp_rx_~hdr~0.base=4127, ppp_rx_~hdr~0.offset=4157, ppp_rx_~ppp~2.base=4174, ppp_rx_~ppp~2.offset=(- 435), ppp_rx_~skb.base=0, ppp_rx_~skb.offset=0, ppp_rx_~tmp___0~5.base=4174, ppp_rx_~tmp___0~5.offset=0, ppp_rx_~tmp~15.base=4174, ppp_rx_~tmp~15.offset=(- 435), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call spin_unlock_irqrestore(~ppp~2.base, 435 + ~ppp~2.offset, ~flags~0); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |spin_unlock_irqrestore_#in~flags|=4124, |spin_unlock_irqrestore_#in~lock.base|=4174, |spin_unlock_irqrestore_#in~lock.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~lock.base, ~lock.offset := #in~lock.base, #in~lock.offset;~flags := #in~flags;call _raw_spin_unlock_irqrestore(~lock.base, ~lock.offset, ~flags); VAL [spin_unlock_irqrestore_~flags=4124, spin_unlock_irqrestore_~lock.base=4174, spin_unlock_irqrestore_~lock.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |spin_unlock_irqrestore_#in~flags|=4124, |spin_unlock_irqrestore_#in~lock.base|=4174, |spin_unlock_irqrestore_#in~lock.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [spin_unlock_irqrestore_~flags=4124, spin_unlock_irqrestore_~lock.base=4174, spin_unlock_irqrestore_~lock.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |spin_unlock_irqrestore_#in~flags|=4124, |spin_unlock_irqrestore_#in~lock.base|=4174, |spin_unlock_irqrestore_#in~lock.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1419#return; VAL [ppp_rx_~dev~0.base=4113, ppp_rx_~dev~0.offset=(- 3264), ppp_rx_~flags~0=4124, ppp_rx_~hdr~0.base=4127, ppp_rx_~hdr~0.offset=4157, ppp_rx_~ppp~2.base=4174, ppp_rx_~ppp~2.offset=(- 435), ppp_rx_~skb.base=0, ppp_rx_~skb.offset=0, ppp_rx_~tmp___0~5.base=4174, ppp_rx_~tmp___0~5.offset=0, ppp_rx_~tmp~15.base=4174, ppp_rx_~tmp~15.offset=(- 435), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call dev_kfree_skb_any(~skb.base, ~skb.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |dev_kfree_skb_any_#in~skb.base|=0, |dev_kfree_skb_any_#in~skb.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~skb.base, ~skb.offset := #in~skb.base, #in~skb.offset;call __dev_kfree_skb_any(~skb.base, ~skb.offset, 1); VAL [dev_kfree_skb_any_~skb.base=0, dev_kfree_skb_any_~skb.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |dev_kfree_skb_any_#in~skb.base|=0, |dev_kfree_skb_any_#in~skb.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [dev_kfree_skb_any_~skb.base=0, dev_kfree_skb_any_~skb.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |dev_kfree_skb_any_#in~skb.base|=0, |dev_kfree_skb_any_#in~skb.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1421#return; VAL [ppp_rx_~dev~0.base=4113, ppp_rx_~dev~0.offset=(- 3264), ppp_rx_~flags~0=4124, ppp_rx_~hdr~0.base=4127, ppp_rx_~hdr~0.offset=4157, ppp_rx_~ppp~2.base=4174, ppp_rx_~ppp~2.offset=(- 435), ppp_rx_~skb.base=0, ppp_rx_~skb.offset=0, ppp_rx_~tmp___0~5.base=4174, ppp_rx_~tmp___0~5.offset=0, ppp_rx_~tmp~15.base=4174, ppp_rx_~tmp~15.offset=(- 435), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call ppp_tx_flush(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] havoc ~skb~0.base, ~skb~0.offset; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret81.base, #t~ret81.offset := ldv_skb_dequeue_12(~#tx_queue~0.base, ~#tx_queue~0.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_dequeue_12_#in~ldv_func_arg1.base|=4146, |ldv_skb_dequeue_12_#in~ldv_func_arg1.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~ldv_func_arg1.base, ~ldv_func_arg1.offset := #in~ldv_func_arg1.base, #in~ldv_func_arg1.offset;havoc ~tmp~21.base, ~tmp~21.offset; VAL [ldv_skb_dequeue_12_~ldv_func_arg1.base=4146, ldv_skb_dequeue_12_~ldv_func_arg1.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_dequeue_12_#in~ldv_func_arg1.base|=4146, |ldv_skb_dequeue_12_#in~ldv_func_arg1.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret283.base, #t~ret283.offset := ldv_skb_alloc(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] havoc ~skb~2.base, ~skb~2.offset;havoc ~tmp___7~3.base, ~tmp___7~3.offset; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret293.base, #t~ret293.offset := ldv_zalloc(248); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=248, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~size := #in~size;havoc ~p~1.base, ~p~1.offset;havoc ~tmp~2.base, ~tmp~2.offset;havoc ~tmp___0~1;assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647;~tmp___0~1 := #t~nondet38;havoc #t~nondet38; VAL [ldv_zalloc_~size=248, ldv_zalloc_~tmp___0~1=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=248, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !(0 != ~tmp___0~1);call #t~malloc39.base, #t~malloc39.offset := #Ultimate.alloc((if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296)); VAL [ldv_zalloc_~size=248, ldv_zalloc_~tmp___0~1=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=248, |ldv_zalloc_#t~malloc39.base|=1, |ldv_zalloc_#t~malloc39.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #Ultimate.meminit(#t~malloc39.base, #t~malloc39.offset, 1, (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296), (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296)); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |#Ultimate.meminit_#amountOfFields|=1, |#Ultimate.meminit_#product|=248, |#Ultimate.meminit_#ptr.base|=1, |#Ultimate.meminit_#ptr.offset|=0, |#Ultimate.meminit_#sizeOfFields|=248, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] #memory_int := ~initToZeroAtPointerBaseAddress~int(#memory_int, #ptr.base); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |#Ultimate.meminit_#amountOfFields|=1, |#Ultimate.meminit_#product|=248, |#Ultimate.meminit_#ptr.base|=1, |#Ultimate.meminit_#ptr.offset|=0, |#Ultimate.meminit_#sizeOfFields|=248, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |#Ultimate.meminit_#amountOfFields|=1, |#Ultimate.meminit_#product|=248, |#Ultimate.meminit_#ptr.base|=1, |#Ultimate.meminit_#ptr.offset|=0, |#Ultimate.meminit_#sizeOfFields|=248, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1647#return; VAL [ldv_zalloc_~size=248, ldv_zalloc_~tmp___0~1=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=248, |ldv_zalloc_#t~malloc39.base|=1, |ldv_zalloc_#t~malloc39.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp~2.base, ~tmp~2.offset := #t~malloc39.base, #t~malloc39.offset;~p~1.base, ~p~1.offset := ~tmp~2.base, ~tmp~2.offset;assume 0 != (if 0 != (~p~1.base + ~p~1.offset) % 18446744073709551616 then 1 else 0);#res.base, #res.offset := ~p~1.base, ~p~1.offset; VAL [ldv_zalloc_~p~1.base=1, ldv_zalloc_~p~1.offset=0, ldv_zalloc_~size=248, ldv_zalloc_~tmp___0~1=0, ldv_zalloc_~tmp~2.base=1, ldv_zalloc_~tmp~2.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=248, |ldv_zalloc_#res.base|=1, |ldv_zalloc_#res.offset|=0, |ldv_zalloc_#t~malloc39.base|=1, |ldv_zalloc_#t~malloc39.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_zalloc_~p~1.base=1, ldv_zalloc_~p~1.offset=0, ldv_zalloc_~size=248, ldv_zalloc_~tmp___0~1=0, ldv_zalloc_~tmp~2.base=1, ldv_zalloc_~tmp~2.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=248, |ldv_zalloc_#res.base|=1, |ldv_zalloc_#res.offset|=0, |ldv_zalloc_#t~malloc39.base|=1, |ldv_zalloc_#t~malloc39.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1549#return; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_alloc_#t~ret293.base|=1, |ldv_skb_alloc_#t~ret293.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp___7~3.base, ~tmp___7~3.offset := #t~ret293.base, #t~ret293.offset;havoc #t~ret293.base, #t~ret293.offset;~skb~2.base, ~skb~2.offset := ~tmp___7~3.base, ~tmp___7~3.offset; VAL [ldv_skb_alloc_~skb~2.base=1, ldv_skb_alloc_~skb~2.offset=0, ldv_skb_alloc_~tmp___7~3.base=1, ldv_skb_alloc_~tmp___7~3.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !(~skb~2.base == 0 && ~skb~2.offset == 0); VAL [ldv_skb_alloc_~skb~2.base=1, ldv_skb_alloc_~skb~2.offset=0, ldv_skb_alloc_~tmp___7~3.base=1, ldv_skb_alloc_~tmp___7~3.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call ldv_set_add(~LDV_SKBS~0.base, ~LDV_SKBS~0.offset, ~skb~2.base, ~skb~2.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_set_add_#in~e.base|=1, |ldv_set_add_#in~e.offset|=0, |ldv_set_add_#in~set.base|=0, |ldv_set_add_#in~set.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~set.base, ~set.offset := #in~set.base, #in~set.offset;~e.base, ~e.offset := #in~e.base, #in~e.offset;havoc ~i~1;~i~1 := 0; VAL [ldv_set_add_~e.base=1, ldv_set_add_~e.offset=0, ldv_set_add_~i~1=0, ldv_set_add_~set.base=0, ldv_set_add_~set.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_set_add_#in~e.base|=1, |ldv_set_add_#in~e.offset|=0, |ldv_set_add_#in~set.base|=0, |ldv_set_add_#in~set.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !false; VAL [ldv_set_add_~e.base=1, ldv_set_add_~e.offset=0, ldv_set_add_~i~1=0, ldv_set_add_~set.base=0, ldv_set_add_~set.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_set_add_#in~e.base|=1, |ldv_set_add_#in~e.offset|=0, |ldv_set_add_#in~set.base|=0, |ldv_set_add_#in~set.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !(~i~1 < ~last_index~0); VAL [ldv_set_add_~e.base=1, ldv_set_add_~e.offset=0, ldv_set_add_~i~1=0, ldv_set_add_~set.base=0, ldv_set_add_~set.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_set_add_#in~e.base|=1, |ldv_set_add_#in~e.offset|=0, |ldv_set_add_#in~set.base|=0, |ldv_set_add_#in~set.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume ~last_index~0 < 15;call write~$Pointer$(~e.base, ~e.offset, ~#set_impl~0.base, ~#set_impl~0.offset + 8 * ~last_index~0, 8);~last_index~0 := 1 + ~last_index~0; VAL [ldv_set_add_~e.base=1, ldv_set_add_~e.offset=0, ldv_set_add_~i~1=0, ldv_set_add_~set.base=0, ldv_set_add_~set.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_set_add_#in~e.base|=1, |ldv_set_add_#in~e.offset|=0, |ldv_set_add_#in~set.base|=0, |ldv_set_add_#in~set.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_set_add_~e.base=1, ldv_set_add_~e.offset=0, ldv_set_add_~i~1=0, ldv_set_add_~set.base=0, ldv_set_add_~set.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_set_add_#in~e.base|=1, |ldv_set_add_#in~e.offset|=0, |ldv_set_add_#in~set.base|=0, |ldv_set_add_#in~set.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1551#return; VAL [ldv_skb_alloc_~skb~2.base=1, ldv_skb_alloc_~skb~2.offset=0, ldv_skb_alloc_~tmp___7~3.base=1, ldv_skb_alloc_~tmp___7~3.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] #res.base, #res.offset := ~skb~2.base, ~skb~2.offset; VAL [ldv_skb_alloc_~skb~2.base=1, ldv_skb_alloc_~skb~2.offset=0, ldv_skb_alloc_~tmp___7~3.base=1, ldv_skb_alloc_~tmp___7~3.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_alloc_#res.base|=1, |ldv_skb_alloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_skb_alloc_~skb~2.base=1, ldv_skb_alloc_~skb~2.offset=0, ldv_skb_alloc_~tmp___7~3.base=1, ldv_skb_alloc_~tmp___7~3.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_alloc_#res.base|=1, |ldv_skb_alloc_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1599#return; VAL [ldv_skb_dequeue_12_~ldv_func_arg1.base=4146, ldv_skb_dequeue_12_~ldv_func_arg1.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_dequeue_12_#in~ldv_func_arg1.base|=4146, |ldv_skb_dequeue_12_#in~ldv_func_arg1.offset|=0, |ldv_skb_dequeue_12_#t~ret283.base|=1, |ldv_skb_dequeue_12_#t~ret283.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp~21.base, ~tmp~21.offset := #t~ret283.base, #t~ret283.offset;havoc #t~ret283.base, #t~ret283.offset;#res.base, #res.offset := ~tmp~21.base, ~tmp~21.offset; VAL [ldv_skb_dequeue_12_~ldv_func_arg1.base=4146, ldv_skb_dequeue_12_~ldv_func_arg1.offset=0, ldv_skb_dequeue_12_~tmp~21.base=1, ldv_skb_dequeue_12_~tmp~21.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_dequeue_12_#in~ldv_func_arg1.base|=4146, |ldv_skb_dequeue_12_#in~ldv_func_arg1.offset|=0, |ldv_skb_dequeue_12_#res.base|=1, |ldv_skb_dequeue_12_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_skb_dequeue_12_~ldv_func_arg1.base=4146, ldv_skb_dequeue_12_~ldv_func_arg1.offset=0, ldv_skb_dequeue_12_~tmp~21.base=1, ldv_skb_dequeue_12_~tmp~21.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_dequeue_12_#in~ldv_func_arg1.base|=4146, |ldv_skb_dequeue_12_#in~ldv_func_arg1.offset|=0, |ldv_skb_dequeue_12_#res.base|=1, |ldv_skb_dequeue_12_#res.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1595#return; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_tx_flush_#t~ret81.base|=1, |ppp_tx_flush_#t~ret81.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~skb~0.base, ~skb~0.offset := #t~ret81.base, #t~ret81.offset;havoc #t~ret81.base, #t~ret81.offset; VAL [ppp_tx_flush_~skb~0.base=1, ppp_tx_flush_~skb~0.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 != (~skb~0.base + ~skb~0.offset) % 18446744073709551616; VAL [ppp_tx_flush_~skb~0.base=1, ppp_tx_flush_~skb~0.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] call #t~ret80 := dev_queue_xmit(~skb~0.base, ~skb~0.offset);assume -2147483648 <= #t~ret80 && #t~ret80 <= 2147483647;havoc #t~ret80; VAL [ppp_tx_flush_~skb~0.base=1, ppp_tx_flush_~skb~0.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret81.base, #t~ret81.offset := ldv_skb_dequeue_12(~#tx_queue~0.base, ~#tx_queue~0.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_dequeue_12_#in~ldv_func_arg1.base|=4146, |ldv_skb_dequeue_12_#in~ldv_func_arg1.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~ldv_func_arg1.base, ~ldv_func_arg1.offset := #in~ldv_func_arg1.base, #in~ldv_func_arg1.offset;havoc ~tmp~21.base, ~tmp~21.offset; VAL [ldv_skb_dequeue_12_~ldv_func_arg1.base=4146, ldv_skb_dequeue_12_~ldv_func_arg1.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_dequeue_12_#in~ldv_func_arg1.base|=4146, |ldv_skb_dequeue_12_#in~ldv_func_arg1.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret283.base, #t~ret283.offset := ldv_skb_alloc(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] havoc ~skb~2.base, ~skb~2.offset;havoc ~tmp___7~3.base, ~tmp___7~3.offset; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret293.base, #t~ret293.offset := ldv_zalloc(248); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=248, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~size := #in~size;havoc ~p~1.base, ~p~1.offset;havoc ~tmp~2.base, ~tmp~2.offset;havoc ~tmp___0~1;assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647;~tmp___0~1 := #t~nondet38;havoc #t~nondet38; VAL [ldv_zalloc_~size=248, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=248, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 != ~tmp___0~1;#res.base, #res.offset := 0, 0; VAL [ldv_zalloc_~size=248, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=248, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_zalloc_~size=248, ldv_zalloc_~tmp___0~1=1, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_zalloc_#in~size|=248, |ldv_zalloc_#res.base|=0, |ldv_zalloc_#res.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1549#return; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_alloc_#t~ret293.base|=0, |ldv_skb_alloc_#t~ret293.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp___7~3.base, ~tmp___7~3.offset := #t~ret293.base, #t~ret293.offset;havoc #t~ret293.base, #t~ret293.offset;~skb~2.base, ~skb~2.offset := ~tmp___7~3.base, ~tmp___7~3.offset; VAL [ldv_skb_alloc_~skb~2.base=0, ldv_skb_alloc_~skb~2.offset=0, ldv_skb_alloc_~tmp___7~3.base=0, ldv_skb_alloc_~tmp___7~3.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume ~skb~2.base == 0 && ~skb~2.offset == 0;#res.base, #res.offset := 0, 0; VAL [ldv_skb_alloc_~skb~2.base=0, ldv_skb_alloc_~skb~2.offset=0, ldv_skb_alloc_~tmp___7~3.base=0, ldv_skb_alloc_~tmp___7~3.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_alloc_#res.base|=0, |ldv_skb_alloc_#res.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_skb_alloc_~skb~2.base=0, ldv_skb_alloc_~skb~2.offset=0, ldv_skb_alloc_~tmp___7~3.base=0, ldv_skb_alloc_~tmp___7~3.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_alloc_#res.base|=0, |ldv_skb_alloc_#res.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1599#return; VAL [ldv_skb_dequeue_12_~ldv_func_arg1.base=4146, ldv_skb_dequeue_12_~ldv_func_arg1.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_dequeue_12_#in~ldv_func_arg1.base|=4146, |ldv_skb_dequeue_12_#in~ldv_func_arg1.offset|=0, |ldv_skb_dequeue_12_#t~ret283.base|=0, |ldv_skb_dequeue_12_#t~ret283.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~tmp~21.base, ~tmp~21.offset := #t~ret283.base, #t~ret283.offset;havoc #t~ret283.base, #t~ret283.offset;#res.base, #res.offset := ~tmp~21.base, ~tmp~21.offset; VAL [ldv_skb_dequeue_12_~ldv_func_arg1.base=4146, ldv_skb_dequeue_12_~ldv_func_arg1.offset=0, ldv_skb_dequeue_12_~tmp~21.base=0, ldv_skb_dequeue_12_~tmp~21.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_dequeue_12_#in~ldv_func_arg1.base|=4146, |ldv_skb_dequeue_12_#in~ldv_func_arg1.offset|=0, |ldv_skb_dequeue_12_#res.base|=0, |ldv_skb_dequeue_12_#res.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_skb_dequeue_12_~ldv_func_arg1.base=4146, ldv_skb_dequeue_12_~ldv_func_arg1.offset=0, ldv_skb_dequeue_12_~tmp~21.base=0, ldv_skb_dequeue_12_~tmp~21.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_skb_dequeue_12_#in~ldv_func_arg1.base|=4146, |ldv_skb_dequeue_12_#in~ldv_func_arg1.offset|=0, |ldv_skb_dequeue_12_#res.base|=0, |ldv_skb_dequeue_12_#res.offset|=0, |old(~last_index~0)|=1, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1595#return; VAL [ppp_tx_flush_~skb~0.base=1, ppp_tx_flush_~skb~0.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_tx_flush_#t~ret81.base|=0, |ppp_tx_flush_#t~ret81.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~skb~0.base, ~skb~0.offset := #t~ret81.base, #t~ret81.offset;havoc #t~ret81.base, #t~ret81.offset; VAL [ppp_tx_flush_~skb~0.base=0, ppp_tx_flush_~skb~0.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !(0 != (~skb~0.base + ~skb~0.offset) % 18446744073709551616); VAL [ppp_tx_flush_~skb~0.base=0, ppp_tx_flush_~skb~0.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ppp_tx_flush_~skb~0.base=0, ppp_tx_flush_~skb~0.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1423#return; VAL [ppp_rx_~dev~0.base=4113, ppp_rx_~dev~0.offset=(- 3264), ppp_rx_~flags~0=4124, ppp_rx_~hdr~0.base=4127, ppp_rx_~hdr~0.offset=4157, ppp_rx_~ppp~2.base=4174, ppp_rx_~ppp~2.offset=(- 435), ppp_rx_~skb.base=0, ppp_rx_~skb.offset=0, ppp_rx_~tmp___0~5.base=4174, ppp_rx_~tmp___0~5.offset=0, ppp_rx_~tmp~15.base=4174, ppp_rx_~tmp~15.offset=(- 435), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] #res := 1; VAL [ppp_rx_~dev~0.base=4113, ppp_rx_~dev~0.offset=(- 3264), ppp_rx_~flags~0=4124, ppp_rx_~hdr~0.base=4127, ppp_rx_~hdr~0.offset=4157, ppp_rx_~ppp~2.base=4174, ppp_rx_~ppp~2.offset=(- 435), ppp_rx_~skb.base=0, ppp_rx_~skb.offset=0, ppp_rx_~tmp___0~5.base=4174, ppp_rx_~tmp___0~5.offset=0, ppp_rx_~tmp~15.base=4174, ppp_rx_~tmp~15.offset=(- 435), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |ppp_rx_#res|=1, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ppp_rx_~dev~0.base=4113, ppp_rx_~dev~0.offset=(- 3264), ppp_rx_~flags~0=4124, ppp_rx_~hdr~0.base=4127, ppp_rx_~hdr~0.offset=4157, ppp_rx_~ppp~2.base=4174, ppp_rx_~ppp~2.offset=(- 435), ppp_rx_~skb.base=0, ppp_rx_~skb.offset=0, ppp_rx_~tmp___0~5.base=4174, ppp_rx_~tmp___0~5.offset=0, ppp_rx_~tmp~15.base=4174, ppp_rx_~tmp~15.offset=(- 435), |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |ppp_rx_#in~skb.base|=0, |ppp_rx_#in~skb.offset|=0, |ppp_rx_#res|=1, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1475#return; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~ret270|=1, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume -2147483648 <= #t~ret270 && #t~ret270 <= 2147483647;havoc #t~ret270;~ldv_state_variable_3~0 := 1; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !(3 == ~ldv_state_variable_3~0); VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !(2 == ~ldv_state_variable_3~0); VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !(5 == ~ldv_state_variable_3~0); VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=2, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume -2147483648 <= #t~nondet252 && #t~nondet252 <= 2147483647;~tmp___6~1 := #t~nondet252;havoc #t~nondet252;#t~switch253 := 0 == ~tmp___6~1; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=false, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !#t~switch253;#t~switch253 := #t~switch253 || 1 == ~tmp___6~1; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume #t~switch253; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=1, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 0 != ~ldv_state_variable_0~0;assume -2147483648 <= #t~nondet254 && #t~nondet254 <= 2147483647;~tmp___7~1 := #t~nondet254;havoc #t~nondet254;#t~switch255 := 0 == ~tmp___7~1; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=0, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume #t~switch255; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=0, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume 3 == ~ldv_state_variable_0~0 && 0 == ~ref_cnt~0; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=0, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call mod_exit(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] call unregister_hdlc_protocol(~#proto~0.base, ~#proto~0.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1441#return; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=0, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~ldv_state_variable_0~0 := 2; VAL [main_~ldvarg0~0.base=0, main_~ldvarg0~0.offset=0, main_~ldvarg1~0=4110, main_~ldvarg2~0.base=0, main_~ldvarg2~0.offset=0, main_~ldvarg3~0.base=0, main_~ldvarg3~0.offset=0, main_~ldvarg4~0=4173, main_~ldvarg5~0.base=0, main_~ldvarg5~0.offset=0, main_~ldvarg6~0.base=0, main_~ldvarg6~0.offset=0, main_~tmp___0~9=4110, main_~tmp___1~3=4173, main_~tmp___2~5.base=0, main_~tmp___2~5.offset=0, main_~tmp___3~2.base=0, main_~tmp___3~2.offset=0, main_~tmp___4~3.base=0, main_~tmp___4~3.offset=0, main_~tmp___5~1.base=0, main_~tmp___5~1.offset=0, main_~tmp___6~1=1, main_~tmp___7~1=0, main_~tmp___8~0=4, main_~tmp~20.base=0, main_~tmp~20.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |main_#t~switch253|=true, |main_#t~switch255|=true, |main_#t~switch258|=true, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call ldv_check_final_state(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] havoc ~tmp___7~7; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret297 := ldv_set_is_empty(~LDV_SKBS~0.base, ~LDV_SKBS~0.offset); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_set_is_empty_#in~set.base|=0, |ldv_set_is_empty_#in~set.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ~set.base, ~set.offset := #in~set.base, #in~set.offset;#res := (if 0 == ~last_index~0 then 1 else 0); VAL [ldv_set_is_empty_~set.base=0, ldv_set_is_empty_~set.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_set_is_empty_#in~set.base|=0, |ldv_set_is_empty_#in~set.offset|=0, |ldv_set_is_empty_#res|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume true; VAL [ldv_set_is_empty_~set.base=0, ldv_set_is_empty_~set.offset=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_set_is_empty_#in~set.base|=0, |ldv_set_is_empty_#in~set.offset|=0, |ldv_set_is_empty_#res|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET #1643#return; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |ldv_check_final_state_#t~ret297|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume -2147483648 <= #t~ret297 && #t~ret297 <= 2147483647;~tmp___7~7 := #t~ret297;havoc #t~ret297; VAL [ldv_check_final_state_~tmp___7~7=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !(0 != ~tmp___7~7); VAL [ldv_check_final_state_~tmp___7~7=0, |#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call ldv_error(); VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] assume !false; VAL [|#NULL.base|=0, |#NULL.offset|=0, |#t~string114.base|=4135, |#t~string114.offset|=0, |#t~string121.base|=4107, |#t~string121.offset|=0, |#t~string211.base|=4165, |#t~string211.offset|=0, |#t~string22.base|=4175, |#t~string22.offset|=0, |#t~string237.base|=4114, |#t~string237.offset|=0, |#t~string64.base|=4171, |#t~string64.offset|=0, |#t~string65.base|=4154, |#t~string65.offset|=0, |#t~string66.base|=4151, |#t~string66.offset|=0, |#t~string84.base|=4163, |#t~string84.offset|=0, |old(~last_index~0)|=0, |old(~LDV_IN_INTERRUPT~0)|=1, |old(~ldv_retval_0~0)|=0, |old(~ldv_state_variable_0~0)|=0, |old(~ldv_state_variable_1~0)|=0, |old(~ldv_state_variable_2~0)|=0, |old(~ldv_state_variable_3~0)|=0, |old(~ldv_timer_list_1~0.base)|=0, |old(~ldv_timer_list_1~0.offset)|=0, |old(~ldv_timer_state_1~0)|=0, |old(~proto_group0~0.base)|=0, |old(~proto_group0~0.offset)|=0, |old(~proto_group1~0.base)|=0, |old(~proto_group1~0.offset)|=0, |old(~ref_cnt~0)|=0, |~#__this_module~0.base|=4178, |~#__this_module~0.offset|=4142, |~#cp_table~0.base|=4119, |~#cp_table~0.offset|=0, |~#ppp_header_ops~0.base|=4133, |~#ppp_header_ops~0.offset|=0, |~#proto~0.base|=4139, |~#proto~0.offset|=0, |~#set_impl~0.base|=4156, |~#set_impl~0.offset|=0, |~#tx_queue~0.base|=4146, |~#tx_queue~0.offset|=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call ULTIMATE.init(); VAL [#NULL.base=4128, #NULL.offset=4164, #t~string114.base=4136, #t~string114.offset=4161, #t~string121.base=4106, #t~string121.offset=4144, #t~string211.base=4166, #t~string211.offset=4109, #t~string22.base=4176, #t~string22.offset=4143, #t~string237.base=4115, #t~string237.offset=4138, #t~string64.base=4172, #t~string64.offset=4155, #t~string65.base=4153, #t~string65.offset=4180, #t~string66.base=4150, #t~string66.offset=4103, #t~string84.base=4158, #t~string84.offset=4112, old(#NULL.base)=4128, old(#NULL.offset)=4164, old(#t~string114.base)=4136, old(#t~string114.offset)=4161, old(#t~string121.base)=4106, old(#t~string121.offset)=4144, old(#t~string211.base)=4166, old(#t~string211.offset)=4109, old(#t~string22.base)=4176, old(#t~string22.offset)=4143, old(#t~string237.base)=4115, old(#t~string237.offset)=4138, old(#t~string64.base)=4172, old(#t~string64.offset)=4155, old(#t~string65.base)=4153, old(#t~string65.offset)=4180, old(#t~string66.base)=4150, old(#t~string66.offset)=4103, old(#t~string84.base)=4158, old(#t~string84.offset)=4112, old(~#cp_table~0.base)=4118, old(~#cp_table~0.offset)=4140, old(~#ppp_header_ops~0.base)=4131, old(~#ppp_header_ops~0.offset)=4126, old(~#proto~0.base)=4137, old(~#proto~0.offset)=4152, old(~#set_impl~0.base)=4168, old(~#set_impl~0.offset)=4123, old(~#tx_queue~0.base)=4159, old(~#tx_queue~0.offset)=4117, old(~last_index~0)=4160, old(~LDV_IN_INTERRUPT~0)=4120, old(~ldv_retval_0~0)=4116, old(~LDV_SKBS~0.base)=4104, old(~LDV_SKBS~0.offset)=4125, old(~ldv_state_variable_0~0)=4129, old(~ldv_state_variable_1~0)=4162, old(~ldv_state_variable_2~0)=4149, old(~ldv_state_variable_3~0)=4179, old(~ldv_timer_list_1~0.base)=4169, old(~ldv_timer_list_1~0.offset)=4170, old(~ldv_timer_state_1~0)=4177, old(~proto_group0~0.base)=4141, old(~proto_group0~0.offset)=4145, old(~proto_group1~0.base)=4122, old(~proto_group1~0.offset)=4134, old(~ref_cnt~0)=4147, ~#cp_table~0.base=4118, ~#cp_table~0.offset=4140, ~#ppp_header_ops~0.base=4131, ~#ppp_header_ops~0.offset=4126, ~#proto~0.base=4137, ~#proto~0.offset=4152, ~#set_impl~0.base=4168, ~#set_impl~0.offset=4123, ~#tx_queue~0.base=4159, ~#tx_queue~0.offset=4117, ~last_index~0=4160, ~LDV_IN_INTERRUPT~0=4120, ~ldv_retval_0~0=4116, ~LDV_SKBS~0.base=4104, ~LDV_SKBS~0.offset=4125, ~ldv_state_variable_0~0=4129, ~ldv_state_variable_1~0=4162, ~ldv_state_variable_2~0=4149, ~ldv_state_variable_3~0=4179, ~ldv_timer_list_1~0.base=4169, ~ldv_timer_list_1~0.offset=4170, ~ldv_timer_state_1~0=4177, ~proto_group0~0.base=4141, ~proto_group0~0.offset=4145, ~proto_group1~0.base=4122, ~proto_group1~0.offset=4134, ~ref_cnt~0=4147] [?] #NULL.base, #NULL.offset := 0, 0; [?] #valid := #valid[0 := 0]; [L5195] call #t~string22.base, #t~string22.offset := #Ultimate.alloc(22); [L5448] call #t~string64.base, #t~string64.offset := #Ultimate.alloc(4); [L5448] call write~init~int(76, #t~string64.base, #t~string64.offset, 1); [L5448] call write~init~int(67, #t~string64.base, 1 + #t~string64.offset, 1); [L5448] call write~init~int(80, #t~string64.base, 2 + #t~string64.offset, 1); [L5448] call write~init~int(0, #t~string64.base, 3 + #t~string64.offset, 1); [L5450] call #t~string65.base, #t~string65.offset := #Ultimate.alloc(5); [L5450] call write~init~int(73, #t~string65.base, #t~string65.offset, 1); [L5450] call write~init~int(80, #t~string65.base, 1 + #t~string65.offset, 1); [L5450] call write~init~int(67, #t~string65.base, 2 + #t~string65.offset, 1); [L5450] call write~init~int(80, #t~string65.base, 3 + #t~string65.offset, 1); [L5450] call write~init~int(0, #t~string65.base, 4 + #t~string65.offset, 1); [L5452] call #t~string66.base, #t~string66.offset := #Ultimate.alloc(7); [L5452] call write~init~int(73, #t~string66.base, #t~string66.offset, 1); [L5452] call write~init~int(80, #t~string66.base, 1 + #t~string66.offset, 1); [L5452] call write~init~int(86, #t~string66.base, 2 + #t~string66.offset, 1); [L5452] call write~init~int(54, #t~string66.base, 3 + #t~string66.offset, 1); [L5452] call write~init~int(67, #t~string66.base, 4 + #t~string66.offset, 1); [L5452] call write~init~int(80, #t~string66.base, 5 + #t~string66.offset, 1); [L5452] call write~init~int(0, #t~string66.base, 6 + #t~string66.offset, 1); [L5561] call #t~string84.base, #t~string84.offset := #Ultimate.alloc(30); [L5719] call #t~string114.base, #t~string114.offset := #Ultimate.alloc(7); [L5719] call write~init~int(37, #t~string114.base, #t~string114.offset, 1); [L5719] call write~init~int(115, #t~string114.base, 1 + #t~string114.offset, 1); [L5719] call write~init~int(32, #t~string114.base, 2 + #t~string114.offset, 1); [L5719] call write~init~int(117, #t~string114.base, 3 + #t~string114.offset, 1); [L5719] call write~init~int(112, #t~string114.base, 4 + #t~string114.offset, 1); [L5719] call write~init~int(10, #t~string114.base, 5 + #t~string114.offset, 1); [L5719] call write~init~int(0, #t~string114.base, 6 + #t~string114.offset, 1); [L5736] call #t~string121.base, #t~string121.offset := #Ultimate.alloc(9); [L6035] call #t~string211.base, #t~string211.offset := #Ultimate.alloc(11); [L6163] call #t~string237.base, #t~string237.offset := #Ultimate.alloc(21); [L5333] ~LDV_IN_INTERRUPT~0 := 1; [L5335] ~ldv_state_variable_0~0 := 0; [L5336] ~ldv_state_variable_3~0 := 0; [L5337] ~ldv_timer_state_1~0 := 0; [L5338] ~ldv_state_variable_2~0 := 0; [L5340] ~ref_cnt~0 := 0; [L5341] ~ldv_state_variable_1~0 := 0; [L5595-L5621] call ~#cp_table~0.base, ~#cp_table~0.offset := #Ultimate.alloc(364); [L5595-L5621] call write~init~int(163, ~#cp_table~0.base, ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 4 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 8 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 12 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 16 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 20 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 24 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 28 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 32 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 36 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 40 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 44 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 48 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 52 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 56 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 60 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1026, ~#cp_table~0.base, 64 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 68 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 72 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(133, ~#cp_table~0.base, 76 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 80 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 84 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 88 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 92 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 96 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 100 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 104 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 108 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2048, ~#cp_table~0.base, 112 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(421, ~#cp_table~0.base, 116 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2, ~#cp_table~0.base, 120 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(261, ~#cp_table~0.base, 124 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(262, ~#cp_table~0.base, 128 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(261, ~#cp_table~0.base, 132 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(389, ~#cp_table~0.base, 136 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2048, ~#cp_table~0.base, 140 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(675, ~#cp_table~0.base, 144 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2, ~#cp_table~0.base, 148 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(515, ~#cp_table~0.base, 152 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(516, ~#cp_table~0.base, 156 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(515, ~#cp_table~0.base, 160 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(643, ~#cp_table~0.base, 164 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2048, ~#cp_table~0.base, 168 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2049, ~#cp_table~0.base, 172 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2, ~#cp_table~0.base, 176 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(36, ~#cp_table~0.base, 180 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 184 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(6, ~#cp_table~0.base, 188 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 192 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2048, ~#cp_table~0.base, 196 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2049, ~#cp_table~0.base, 200 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2, ~#cp_table~0.base, 204 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(163, ~#cp_table~0.base, 208 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 212 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(165, ~#cp_table~0.base, 216 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 220 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2048, ~#cp_table~0.base, 224 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2049, ~#cp_table~0.base, 228 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2050, ~#cp_table~0.base, 232 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2051, ~#cp_table~0.base, 236 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2051, ~#cp_table~0.base, 240 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2051, ~#cp_table~0.base, 244 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2114, ~#cp_table~0.base, 248 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 252 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 256 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 260 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(3, ~#cp_table~0.base, 264 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(3, ~#cp_table~0.base, 268 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(5, ~#cp_table~0.base, 272 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 276 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4096, ~#cp_table~0.base, 280 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4097, ~#cp_table~0.base, 284 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4098, ~#cp_table~0.base, 288 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4099, ~#cp_table~0.base, 292 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4100, ~#cp_table~0.base, 296 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4101, ~#cp_table~0.base, 300 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4102, ~#cp_table~0.base, 304 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 308 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 312 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2, ~#cp_table~0.base, 316 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(3, ~#cp_table~0.base, 320 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(3, ~#cp_table~0.base, 324 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(5, ~#cp_table~0.base, 328 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(6, ~#cp_table~0.base, 332 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 336 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 340 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 344 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 348 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 352 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 356 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1058, ~#cp_table~0.base, 360 + ~#cp_table~0.offset, 4); [L6197] ~ldv_retval_0~0 := 0; [L6679] ~last_index~0 := 0; [L5334] ~proto_group1~0.base, ~proto_group1~0.offset := 0, 0; [L5339] ~proto_group0~0.base, ~proto_group0~0.offset := 0, 0; [L5342] ~ldv_timer_list_1~0.base, ~ldv_timer_list_1~0.offset := 0, 0; [L5410] call ~#tx_queue~0.base, ~#tx_queue~0.offset := #Ultimate.alloc(88); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, ~#tx_queue~0.offset, 8); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 8 + ~#tx_queue~0.offset, 8); [L5410] call write~init~int(0, ~#tx_queue~0.base, 16 + ~#tx_queue~0.offset, 4); [L5410] call write~init~int(0, ~#tx_queue~0.base, 20 + ~#tx_queue~0.offset, 4); [L5410] call write~init~int(0, ~#tx_queue~0.base, 24 + ~#tx_queue~0.offset, 4); [L5410] call write~init~int(0, ~#tx_queue~0.base, 28 + ~#tx_queue~0.offset, 4); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 32 + ~#tx_queue~0.offset, 8); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 40 + ~#tx_queue~0.offset, 8); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 48 + ~#tx_queue~0.offset, 8); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 56 + ~#tx_queue~0.offset, 8); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 64 + ~#tx_queue~0.offset, 8); [L5410] call write~init~int(0, ~#tx_queue~0.base, 72 + ~#tx_queue~0.offset, 4); [L5410] call write~init~int(0, ~#tx_queue~0.base, 76 + ~#tx_queue~0.offset, 8); [L6104-L6106] call ~#proto~0.base, ~#proto~0.offset := #Ultimate.alloc(88); [L6104-L6106] call write~init~$Pointer$(0, 0, ~#proto~0.base, ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(#funAddr~ppp_close.base, #funAddr~ppp_close.offset, ~#proto~0.base, 8 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(#funAddr~ppp_start.base, #funAddr~ppp_start.offset, ~#proto~0.base, 16 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(#funAddr~ppp_stop.base, #funAddr~ppp_stop.offset, ~#proto~0.base, 24 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(0, 0, ~#proto~0.base, 32 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(#funAddr~ppp_ioctl.base, #funAddr~ppp_ioctl.offset, ~#proto~0.base, 40 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(#funAddr~ppp_type_trans.base, #funAddr~ppp_type_trans.offset, ~#proto~0.base, 48 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(#funAddr~ppp_rx.base, #funAddr~ppp_rx.offset, ~#proto~0.base, 56 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(0, 0, ~#proto~0.base, 64 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(~#__this_module~0.base, ~#__this_module~0.offset, ~#proto~0.base, 72 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(0, 0, ~#proto~0.base, 80 + ~#proto~0.offset, 8); [L6107] call ~#ppp_header_ops~0.base, ~#ppp_header_ops~0.offset := #Ultimate.alloc(40); [L6107] call write~init~$Pointer$(#funAddr~ppp_hard_header.base, #funAddr~ppp_hard_header.offset, ~#ppp_header_ops~0.base, ~#ppp_header_ops~0.offset, 8); [L6107] call write~init~$Pointer$(0, 0, ~#ppp_header_ops~0.base, 8 + ~#ppp_header_ops~0.offset, 8); [L6107] call write~init~$Pointer$(0, 0, ~#ppp_header_ops~0.base, 16 + ~#ppp_header_ops~0.offset, 8); [L6107] call write~init~$Pointer$(0, 0, ~#ppp_header_ops~0.base, 24 + ~#ppp_header_ops~0.offset, 8); [L6107] call write~init~$Pointer$(0, 0, ~#ppp_header_ops~0.base, 32 + ~#ppp_header_ops~0.offset, 8); [L6678] call ~#set_impl~0.base, ~#set_impl~0.offset := #Ultimate.alloc(120); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 8 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 16 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 24 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 32 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 40 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 48 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 56 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 64 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 72 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 80 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 88 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 96 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 104 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 112 + ~#set_impl~0.offset, 8); [L6836] ~LDV_SKBS~0.base, ~LDV_SKBS~0.offset := 0, 0; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(#NULL.base)=4128, old(#NULL.offset)=4164, old(#t~string114.base)=4136, old(#t~string114.offset)=4161, old(#t~string121.base)=4106, old(#t~string121.offset)=4144, old(#t~string211.base)=4166, old(#t~string211.offset)=4109, old(#t~string22.base)=4176, old(#t~string22.offset)=4143, old(#t~string237.base)=4115, old(#t~string237.offset)=4138, old(#t~string64.base)=4172, old(#t~string64.offset)=4155, old(#t~string65.base)=4153, old(#t~string65.offset)=4180, old(#t~string66.base)=4150, old(#t~string66.offset)=4103, old(#t~string84.base)=4158, old(#t~string84.offset)=4112, old(~#cp_table~0.base)=4118, old(~#cp_table~0.offset)=4140, old(~#ppp_header_ops~0.base)=4131, old(~#ppp_header_ops~0.offset)=4126, old(~#proto~0.base)=4137, old(~#proto~0.offset)=4152, old(~#set_impl~0.base)=4168, old(~#set_impl~0.offset)=4123, old(~#tx_queue~0.base)=4159, old(~#tx_queue~0.offset)=4117, old(~last_index~0)=4160, old(~LDV_IN_INTERRUPT~0)=4120, old(~ldv_retval_0~0)=4116, old(~LDV_SKBS~0.base)=4104, old(~LDV_SKBS~0.offset)=4125, old(~ldv_state_variable_0~0)=4129, old(~ldv_state_variable_1~0)=4162, old(~ldv_state_variable_2~0)=4149, old(~ldv_state_variable_3~0)=4179, old(~ldv_timer_list_1~0.base)=4169, old(~ldv_timer_list_1~0.offset)=4170, old(~ldv_timer_state_1~0)=4177, old(~proto_group0~0.base)=4141, old(~proto_group0~0.offset)=4145, old(~proto_group1~0.base)=4122, old(~proto_group1~0.offset)=4134, old(~ref_cnt~0)=4147, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ensures true; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(#NULL.base)=4128, old(#NULL.offset)=4164, old(#t~string114.base)=4136, old(#t~string114.offset)=4161, old(#t~string121.base)=4106, old(#t~string121.offset)=4144, old(#t~string211.base)=4166, old(#t~string211.offset)=4109, old(#t~string22.base)=4176, old(#t~string22.offset)=4143, old(#t~string237.base)=4115, old(#t~string237.offset)=4138, old(#t~string64.base)=4172, old(#t~string64.offset)=4155, old(#t~string65.base)=4153, old(#t~string65.offset)=4180, old(#t~string66.base)=4150, old(#t~string66.offset)=4103, old(#t~string84.base)=4158, old(#t~string84.offset)=4112, old(~#cp_table~0.base)=4118, old(~#cp_table~0.offset)=4140, old(~#ppp_header_ops~0.base)=4131, old(~#ppp_header_ops~0.offset)=4126, old(~#proto~0.base)=4137, old(~#proto~0.offset)=4152, old(~#set_impl~0.base)=4168, old(~#set_impl~0.offset)=4123, old(~#tx_queue~0.base)=4159, old(~#tx_queue~0.offset)=4117, old(~last_index~0)=4160, old(~LDV_IN_INTERRUPT~0)=4120, old(~ldv_retval_0~0)=4116, old(~LDV_SKBS~0.base)=4104, old(~LDV_SKBS~0.offset)=4125, old(~ldv_state_variable_0~0)=4129, old(~ldv_state_variable_1~0)=4162, old(~ldv_state_variable_2~0)=4149, old(~ldv_state_variable_3~0)=4179, old(~ldv_timer_list_1~0.base)=4169, old(~ldv_timer_list_1~0.offset)=4170, old(~ldv_timer_state_1~0)=4177, old(~proto_group0~0.base)=4141, old(~proto_group0~0.offset)=4145, old(~proto_group1~0.base)=4122, old(~proto_group1~0.offset)=4134, old(~ref_cnt~0)=4147, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] RET call ULTIMATE.init(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret298 := main(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6277] havoc ~ldvarg0~0.base, ~ldvarg0~0.offset; [L6278] havoc ~tmp~20.base, ~tmp~20.offset; [L6279] havoc ~ldvarg1~0; [L6280] havoc ~tmp___0~9; [L6281] havoc ~ldvarg4~0; [L6282] havoc ~tmp___1~3; [L6283] havoc ~ldvarg3~0.base, ~ldvarg3~0.offset; [L6284] havoc ~tmp___2~5.base, ~tmp___2~5.offset; [L6285] havoc ~ldvarg5~0.base, ~ldvarg5~0.offset; [L6286] havoc ~tmp___3~2.base, ~tmp___3~2.offset; [L6287] havoc ~ldvarg2~0.base, ~ldvarg2~0.offset; [L6288] havoc ~tmp___4~3.base, ~tmp___4~3.offset; [L6289] havoc ~ldvarg6~0.base, ~ldvarg6~0.offset; [L6290] havoc ~tmp___5~1.base, ~tmp___5~1.offset; [L6291] havoc ~tmp___6~1; [L6292] havoc ~tmp___7~1; [L6293] havoc ~tmp___8~0; [L6294] havoc ~tmp___9~0; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6297] CALL call #t~ret245.base, #t~ret245.offset := ldv_zalloc(40); VAL [#in~size=40, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1.base, ~p~1.offset; [L5256] havoc ~tmp~2.base, ~tmp~2.offset; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=40, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=40, ~tmp___0~1=1] [L5261-L5268] assume 0 != ~tmp___0~1; [L5262] #res.base, #res.offset := 0, 0; VAL [#in~size=40, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=40, ~tmp___0~1=1] [L5253-L5270] ensures true; VAL [#in~size=40, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=40, ~tmp___0~1=1] [L6297] RET call #t~ret245.base, #t~ret245.offset := ldv_zalloc(40); VAL [#NULL.base=0, #NULL.offset=0, #t~ret245.base=0, #t~ret245.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6297] ~tmp~20.base, ~tmp~20.offset := #t~ret245.base, #t~ret245.offset; [L6297] havoc #t~ret245.base, #t~ret245.offset; [L6298] ~ldvarg0~0.base, ~ldvarg0~0.offset := ~tmp~20.base, ~tmp~20.offset; [L6299] ~tmp___0~9 := #t~nondet246; [L6299] havoc #t~nondet246; [L6300] ~ldvarg1~0 := ~tmp___0~9; [L6301] ~tmp___1~3 := #t~nondet247; [L6301] havoc #t~nondet247; [L6302] ~ldvarg4~0 := ~tmp___1~3; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg4~0=4173, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp~20.base=0, ~tmp~20.offset=0] [L6303] CALL call #t~ret248.base, #t~ret248.offset := ldv_zalloc(232); VAL [#in~size=232, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1.base, ~p~1.offset; [L5256] havoc ~tmp~2.base, ~tmp~2.offset; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=232, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=232, ~tmp___0~1=1] [L5261-L5268] assume 0 != ~tmp___0~1; [L5262] #res.base, #res.offset := 0, 0; VAL [#in~size=232, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=232, ~tmp___0~1=1] [L5253-L5270] ensures true; VAL [#in~size=232, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=232, ~tmp___0~1=1] [L6303] RET call #t~ret248.base, #t~ret248.offset := ldv_zalloc(232); VAL [#NULL.base=0, #NULL.offset=0, #t~ret248.base=0, #t~ret248.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg4~0=4173, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp~20.base=0, ~tmp~20.offset=0] [L6303] ~tmp___2~5.base, ~tmp___2~5.offset := #t~ret248.base, #t~ret248.offset; [L6303] havoc #t~ret248.base, #t~ret248.offset; [L6304] ~ldvarg3~0.base, ~ldvarg3~0.offset := ~tmp___2~5.base, ~tmp___2~5.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp~20.base=0, ~tmp~20.offset=0] [L6305] CALL call #t~ret249.base, #t~ret249.offset := ldv_zalloc(3264); VAL [#in~size=3264, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1.base, ~p~1.offset; [L5256] havoc ~tmp~2.base, ~tmp~2.offset; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=3264, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=3264, ~tmp___0~1=1] [L5261-L5268] assume 0 != ~tmp___0~1; [L5262] #res.base, #res.offset := 0, 0; VAL [#in~size=3264, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=3264, ~tmp___0~1=1] [L5253-L5270] ensures true; VAL [#in~size=3264, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=3264, ~tmp___0~1=1] [L6305] RET call #t~ret249.base, #t~ret249.offset := ldv_zalloc(3264); VAL [#NULL.base=0, #NULL.offset=0, #t~ret249.base=0, #t~ret249.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp~20.base=0, ~tmp~20.offset=0] [L6305] ~tmp___3~2.base, ~tmp___3~2.offset := #t~ret249.base, #t~ret249.offset; [L6305] havoc #t~ret249.base, #t~ret249.offset; [L6306] ~ldvarg5~0.base, ~ldvarg5~0.offset := ~tmp___3~2.base, ~tmp___3~2.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp~20.base=0, ~tmp~20.offset=0] [L6307] CALL call #t~ret250.base, #t~ret250.offset := ldv_zalloc(1); VAL [#in~size=1, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1.base, ~p~1.offset; [L5256] havoc ~tmp~2.base, ~tmp~2.offset; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=1, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=1, ~tmp___0~1=1] [L5261-L5268] assume 0 != ~tmp___0~1; [L5262] #res.base, #res.offset := 0, 0; VAL [#in~size=1, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=1, ~tmp___0~1=1] [L5253-L5270] ensures true; VAL [#in~size=1, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=1, ~tmp___0~1=1] [L6307] RET call #t~ret250.base, #t~ret250.offset := ldv_zalloc(1); VAL [#NULL.base=0, #NULL.offset=0, #t~ret250.base=0, #t~ret250.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp~20.base=0, ~tmp~20.offset=0] [L6307] ~tmp___4~3.base, ~tmp___4~3.offset := #t~ret250.base, #t~ret250.offset; [L6307] havoc #t~ret250.base, #t~ret250.offset; [L6308] ~ldvarg2~0.base, ~ldvarg2~0.offset := ~tmp___4~3.base, ~tmp___4~3.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp~20.base=0, ~tmp~20.offset=0] [L6309] CALL call #t~ret251.base, #t~ret251.offset := ldv_zalloc(1); VAL [#in~size=1, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1.base, ~p~1.offset; [L5256] havoc ~tmp~2.base, ~tmp~2.offset; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=1, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=1, ~tmp___0~1=1] [L5261-L5268] assume 0 != ~tmp___0~1; [L5262] #res.base, #res.offset := 0, 0; VAL [#in~size=1, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=1, ~tmp___0~1=1] [L5253-L5270] ensures true; VAL [#in~size=1, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=1, ~tmp___0~1=1] [L6309] RET call #t~ret251.base, #t~ret251.offset := ldv_zalloc(1); VAL [#NULL.base=0, #NULL.offset=0, #t~ret251.base=0, #t~ret251.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp~20.base=0, ~tmp~20.offset=0] [L6309] ~tmp___5~1.base, ~tmp___5~1.offset := #t~ret251.base, #t~ret251.offset; [L6309] havoc #t~ret251.base, #t~ret251.offset; [L6310] ~ldvarg6~0.base, ~ldvarg6~0.offset := ~tmp___5~1.base, ~tmp___5~1.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp~20.base=0, ~tmp~20.offset=0] [L6311] CALL call ldv_initialize(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6858] CALL call ldv_set_init(~LDV_SKBS~0.base, ~LDV_SKBS~0.offset); VAL [#in~set.base=0, #in~set.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6681-L6690] ~set.base, ~set.offset := #in~set.base, #in~set.offset; [L6686] ~set.base, ~set.offset := ~#set_impl~0.base, ~#set_impl~0.offset; [L6687] ~last_index~0 := 0; VAL [#in~set.base=0, #in~set.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~set.base=4156, ~set.offset=0] [L6680] ensures true; VAL [#in~set.base=0, #in~set.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~set.base=4156, ~set.offset=0] [L6858] RET call ldv_set_init(~LDV_SKBS~0.base, ~LDV_SKBS~0.offset); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6199] ensures true; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6311] RET call ldv_initialize(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp~20.base=0, ~tmp~20.offset=0] [L6312] ~ldv_state_variable_1~0 := 1; [L6313] ~ref_cnt~0 := 0; [L6314] ~ldv_state_variable_0~0 := 1; [L6315] ~ldv_state_variable_3~0 := 0; [L6316] ~ldv_state_variable_2~0 := 0; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp~20.base=0, ~tmp~20.offset=0] [L6318] assume -2147483648 <= #t~nondet252 && #t~nondet252 <= 2147483647; [L6318] ~tmp___6~1 := #t~nondet252; [L6318] havoc #t~nondet252; [L6320] #t~switch253 := 0 == ~tmp___6~1; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6320] assume !#t~switch253; [L6327] #t~switch253 := #t~switch253 || 1 == ~tmp___6~1; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6327] assume #t~switch253; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6328-L6367] assume 0 != ~ldv_state_variable_0~0; [L6329] assume -2147483648 <= #t~nondet254 && #t~nondet254 <= 2147483647; [L6329] ~tmp___7~1 := #t~nondet254; [L6329] havoc #t~nondet254; [L6331] #t~switch255 := 0 == ~tmp___7~1; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6331] assume !#t~switch255; [L6340] #t~switch255 := #t~switch255 || 1 == ~tmp___7~1; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6340] assume #t~switch255; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6341-L6359] assume 1 == ~ldv_state_variable_0~0; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6342] CALL call #t~ret256 := mod_init(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6183] CALL call skb_queue_head_init(~#tx_queue~0.base, ~#tx_queue~0.offset); VAL [#in~list.base=4146, #in~list.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5189-L5199] ~list.base, ~list.offset := #in~list.base, #in~list.offset; [L5191] call ~#__key~0.base, ~#__key~0.offset := #Ultimate.alloc(8); VAL [#in~list.base=4146, #in~list.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__key~0.base=4167, ~#__key~0.offset=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~list.base=4146, ~list.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5194] CALL call #t~ret21.base, #t~ret21.offset := spinlock_check(~list.base, 20 + ~list.offset); VAL [#in~lock.base=4146, #in~lock.offset=20, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5132-L5139] ~lock.base, ~lock.offset := #in~lock.base, #in~lock.offset; [L5137] #res.base, #res.offset := ~lock.base, ~lock.offset; VAL [#in~lock.base=4146, #in~lock.offset=20, #NULL.base=0, #NULL.offset=0, #res.base=4146, #res.offset=20, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~lock.base=4146, ~lock.offset=20, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5132-L5139] ensures true; VAL [#in~lock.base=4146, #in~lock.offset=20, #NULL.base=0, #NULL.offset=0, #res.base=4146, #res.offset=20, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~lock.base=4146, ~lock.offset=20, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5194] RET call #t~ret21.base, #t~ret21.offset := spinlock_check(~list.base, 20 + ~list.offset); VAL [#in~list.base=4146, #in~list.offset=0, #NULL.base=0, #NULL.offset=0, #t~ret21.base=4146, #t~ret21.offset=20, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__key~0.base=4167, ~#__key~0.offset=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~list.base=4146, ~list.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5194] havoc #t~ret21.base, #t~ret21.offset; [L5195] call __raw_spin_lock_init(~list.base, 20 + ~list.offset, #t~string22.base, #t~string22.offset, ~#__key~0.base, ~#__key~0.offset); VAL [#in~list.base=4146, #in~list.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__key~0.base=4167, ~#__key~0.offset=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~list.base=4146, ~list.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5196] CALL call __skb_queue_head_init(~list.base, ~list.offset); VAL [#in~list.base=4146, #in~list.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5177-L5188] ~list.base, ~list.offset := #in~list.base, #in~list.offset; [L5179] havoc ~tmp~0.base, ~tmp~0.offset; [L5182] ~tmp~0.base, ~tmp~0.offset := ~list.base, ~list.offset; [L5183] call write~$Pointer$(~tmp~0.base, ~tmp~0.offset, ~list.base, ~list.offset, 8); [L5184] call write~$Pointer$(~tmp~0.base, ~tmp~0.offset, ~list.base, 8 + ~list.offset, 8); [L5185] call write~int(0, ~list.base, 16 + ~list.offset, 4); VAL [#in~list.base=4146, #in~list.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~list.base=4146, ~list.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp~0.base=4146, ~tmp~0.offset=0] [L5177-L5188] ensures true; VAL [#in~list.base=4146, #in~list.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~list.base=4146, ~list.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp~0.base=4146, ~tmp~0.offset=0] [L5196] RET call __skb_queue_head_init(~list.base, ~list.offset); VAL [#in~list.base=4146, #in~list.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__key~0.base=4167, ~#__key~0.offset=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~list.base=4146, ~list.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5191] call ULTIMATE.dealloc(~#__key~0.base, ~#__key~0.offset); [L5197] havoc ~#__key~0.base, ~#__key~0.offset; VAL [#in~list.base=4146, #in~list.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~list.base=4146, ~list.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5189-L5199] ensures true; VAL [#in~list.base=4146, #in~list.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~list.base=4146, ~list.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6183] RET call skb_queue_head_init(~#tx_queue~0.base, ~#tx_queue~0.offset); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6184] call register_hdlc_protocol(~#proto~0.base, ~#proto~0.offset); [L6185] #res := 0; VAL [#NULL.base=0, #NULL.offset=0, #res=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6178-L6187] ensures true; VAL [#NULL.base=0, #NULL.offset=0, #res=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6342] RET call #t~ret256 := mod_init(); VAL [#NULL.base=0, #NULL.offset=0, #t~ret256=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6342] assume -2147483648 <= #t~ret256 && #t~ret256 <= 2147483647; [L6342] ~ldv_retval_0~0 := #t~ret256; [L6342] havoc #t~ret256; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6343-L6350] assume 0 == ~ldv_retval_0~0; [L6344] ~ldv_state_variable_0~0 := 3; [L6345] ~ldv_state_variable_2~0 := 1; [L6346] ~ldv_state_variable_3~0 := 1; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6347] CALL call ldv_initialize_hdlc_proto_3(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6228] havoc ~tmp~19.base, ~tmp~19.offset; [L6229] havoc ~tmp___0~8.base, ~tmp___0~8.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6232] CALL call #t~ret239.base, #t~ret239.offset := ldv_zalloc(3264); VAL [#in~size=3264, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1.base, ~p~1.offset; [L5256] havoc ~tmp~2.base, ~tmp~2.offset; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=3264, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=3264, ~tmp___0~1=1] [L5261-L5268] assume 0 != ~tmp___0~1; [L5262] #res.base, #res.offset := 0, 0; VAL [#in~size=3264, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=3264, ~tmp___0~1=1] [L5253-L5270] ensures true; VAL [#in~size=3264, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=3264, ~tmp___0~1=1] [L6232] RET call #t~ret239.base, #t~ret239.offset := ldv_zalloc(3264); VAL [#NULL.base=0, #NULL.offset=0, #t~ret239.base=0, #t~ret239.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6232] ~tmp~19.base, ~tmp~19.offset := #t~ret239.base, #t~ret239.offset; [L6232] havoc #t~ret239.base, #t~ret239.offset; [L6233] ~proto_group1~0.base, ~proto_group1~0.offset := ~tmp~19.base, ~tmp~19.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp~19.base=0, ~tmp~19.offset=0] [L6234] CALL call #t~ret240.base, #t~ret240.offset := ldv_zalloc(232); VAL [#in~size=232, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1.base, ~p~1.offset; [L5256] havoc ~tmp~2.base, ~tmp~2.offset; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=232, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=232, ~tmp___0~1=1] [L5261-L5268] assume 0 != ~tmp___0~1; [L5262] #res.base, #res.offset := 0, 0; VAL [#in~size=232, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=232, ~tmp___0~1=1] [L5253-L5270] ensures true; VAL [#in~size=232, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=232, ~tmp___0~1=1] [L6234] RET call #t~ret240.base, #t~ret240.offset := ldv_zalloc(232); VAL [#NULL.base=0, #NULL.offset=0, #t~ret240.base=0, #t~ret240.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp~19.base=0, ~tmp~19.offset=0] [L6234] ~tmp___0~8.base, ~tmp___0~8.offset := #t~ret240.base, #t~ret240.offset; [L6234] havoc #t~ret240.base, #t~ret240.offset; [L6235] ~proto_group0~0.base, ~proto_group0~0.offset := ~tmp___0~8.base, ~tmp___0~8.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~8.base=0, ~tmp___0~8.offset=0, ~tmp~19.base=0, ~tmp~19.offset=0] [L5344] ensures true; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~8.base=0, ~tmp___0~8.offset=0, ~tmp~19.base=0, ~tmp~19.offset=0] [L6347] RET call ldv_initialize_hdlc_proto_3(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6351-L6356] assume !(0 != ~ldv_retval_0~0); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6318] assume -2147483648 <= #t~nondet252 && #t~nondet252 <= 2147483647; [L6318] ~tmp___6~1 := #t~nondet252; [L6318] havoc #t~nondet252; [L6320] #t~switch253 := 0 == ~tmp___6~1; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=false, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6320] assume !#t~switch253; [L6327] #t~switch253 := #t~switch253 || 1 == ~tmp___6~1; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=false, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6327] assume !#t~switch253; [L6369] #t~switch253 := #t~switch253 || 2 == ~tmp___6~1; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6369] assume #t~switch253; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp~20.base=0, ~tmp~20.offset=0] [L6370-L6545] assume 0 != ~ldv_state_variable_3~0; [L6371] assume -2147483648 <= #t~nondet257 && #t~nondet257 <= 2147483647; [L6371] ~tmp___8~0 := #t~nondet257; [L6371] havoc #t~nondet257; [L6373] #t~switch258 := 0 == ~tmp___8~0; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6373] assume !#t~switch258; [L6381] #t~switch258 := #t~switch258 || 1 == ~tmp___8~0; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6381] assume !#t~switch258; [L6413] #t~switch258 := #t~switch258 || 2 == ~tmp___8~0; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6413] assume !#t~switch258; [L6445] #t~switch258 := #t~switch258 || 3 == ~tmp___8~0; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6445] assume !#t~switch258; [L6453] #t~switch258 := #t~switch258 || 4 == ~tmp___8~0; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6453] assume #t~switch258; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6454-L6459] assume !(4 == ~ldv_state_variable_3~0); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6460-L6465] assume 1 == ~ldv_state_variable_3~0; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6461] CALL call #t~ret270 := ppp_rx(~proto_group0~0.base, ~proto_group0~0.offset); VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5863-L6001] ~skb.base, ~skb.offset := #in~skb.base, #in~skb.offset; [L5865] havoc ~hdr~0.base, ~hdr~0.offset; [L5866] havoc ~dev~0.base, ~dev~0.offset; [L5867] havoc ~ppp~2.base, ~ppp~2.offset; [L5868] havoc ~tmp~15.base, ~tmp~15.offset; [L5869] havoc ~proto___0~1.base, ~proto___0~1.offset; [L5870] havoc ~cp~1.base, ~cp~1.offset; [L5871] havoc ~flags~0; [L5872] havoc ~len~1; [L5873] havoc ~pid~0; [L5874] havoc ~tmp___0~5.base, ~tmp___0~5.offset; [L5875] havoc ~tmp___1~1.base, ~tmp___1~1.offset; [L5876] havoc ~tmp___2~3; [L5877] havoc ~tmp___3~1; [L5878] havoc ~tmp___4~2; [L5881] call #t~mem149.base, #t~mem149.offset := read~$Pointer$(~skb.base, 232 + ~skb.offset, 8); [L5881] ~hdr~0.base, ~hdr~0.offset := #t~mem149.base, #t~mem149.offset; [L5881] havoc #t~mem149.base, #t~mem149.offset; [L5882] call #t~mem150.base, #t~mem150.offset := read~$Pointer$(~skb.base, 32 + ~skb.offset, 8); [L5882] ~dev~0.base, ~dev~0.offset := #t~mem150.base, #t~mem150.offset; [L5882] havoc #t~mem150.base, #t~mem150.offset; VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev~0.base=4113, ~dev~0.offset=-3264, ~hdr~0.base=4127, ~hdr~0.offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0] [L5883] CALL call #t~ret151.base, #t~ret151.offset := get_ppp(~dev~0.base, ~dev~0.offset); VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5412-L5420] ~dev.base, ~dev.offset := #in~dev.base, #in~dev.offset; [L5414] havoc ~tmp~9.base, ~tmp~9.offset; VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev.base=4113, ~dev.offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5417] CALL call #t~ret59.base, #t~ret59.offset := dev_to_hdlc(~dev.base, ~dev.offset); VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5400-L5408] ~dev.base, ~dev.offset := #in~dev.base, #in~dev.offset; [L5402] havoc ~tmp~8.base, ~tmp~8.offset; VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev.base=4113, ~dev.offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5405] CALL call #t~ret55.base, #t~ret55.offset := netdev_priv(~dev.base, ~dev.offset); VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5348-L5355] ~dev.base, ~dev.offset := #in~dev.base, #in~dev.offset; [L5353] #res.base, #res.offset := ~dev.base, 3264 + ~dev.offset; VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #res.base=4113, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev.base=4113, ~dev.offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5348-L5355] ensures true; VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #res.base=4113, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev.base=4113, ~dev.offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5405] RET call #t~ret55.base, #t~ret55.offset := netdev_priv(~dev.base, ~dev.offset); VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #t~ret55.base=4113, #t~ret55.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev.base=4113, ~dev.offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5405] ~tmp~8.base, ~tmp~8.offset := #t~ret55.base, #t~ret55.offset; [L5405] havoc #t~ret55.base, #t~ret55.offset; [L5406] #res.base, #res.offset := ~tmp~8.base, ~tmp~8.offset; VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #res.base=4113, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev.base=4113, ~dev.offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp~8.base=4113, ~tmp~8.offset=0] [L5400-L5408] ensures true; VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #res.base=4113, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev.base=4113, ~dev.offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp~8.base=4113, ~tmp~8.offset=0] [L5417] RET call #t~ret59.base, #t~ret59.offset := dev_to_hdlc(~dev.base, ~dev.offset); VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #t~ret59.base=4113, #t~ret59.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev.base=4113, ~dev.offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5417] ~tmp~9.base, ~tmp~9.offset := #t~ret59.base, #t~ret59.offset; [L5417] havoc #t~ret59.base, #t~ret59.offset; [L5418] call #t~mem60.base, #t~mem60.offset := read~$Pointer$(~tmp~9.base, 100 + ~tmp~9.offset, 8); [L5418] #res.base, #res.offset := #t~mem60.base, #t~mem60.offset; [L5418] havoc #t~mem60.base, #t~mem60.offset; VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #res.base=4174, #res.offset=-435, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev.base=4113, ~dev.offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp~9.base=4113, ~tmp~9.offset=0] [L5412-L5420] ensures true; VAL [#in~dev.base=4113, #in~dev.offset=-3264, #NULL.base=0, #NULL.offset=0, #res.base=4174, #res.offset=-435, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev.base=4113, ~dev.offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp~9.base=4113, ~tmp~9.offset=0] [L5883] RET call #t~ret151.base, #t~ret151.offset := get_ppp(~dev~0.base, ~dev~0.offset); VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~ret151.base=4174, #t~ret151.offset=-435, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev~0.base=4113, ~dev~0.offset=-3264, ~hdr~0.base=4127, ~hdr~0.offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0] [L5883] ~tmp~15.base, ~tmp~15.offset := #t~ret151.base, #t~ret151.offset; [L5883] havoc #t~ret151.base, #t~ret151.offset; [L5884] ~ppp~2.base, ~ppp~2.offset := ~tmp~15.base, ~tmp~15.offset; VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev~0.base=4113, ~dev~0.offset=-3264, ~hdr~0.base=4127, ~hdr~0.offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ppp~2.base=4174, ~ppp~2.offset=-435, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0, ~tmp~15.base=4174, ~tmp~15.offset=-435] [L5885] CALL call #t~ret152.base, #t~ret152.offset := spinlock_check(~ppp~2.base, 435 + ~ppp~2.offset); VAL [#in~lock.base=4174, #in~lock.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5132-L5139] ~lock.base, ~lock.offset := #in~lock.base, #in~lock.offset; [L5137] #res.base, #res.offset := ~lock.base, ~lock.offset; VAL [#in~lock.base=4174, #in~lock.offset=0, #NULL.base=0, #NULL.offset=0, #res.base=4174, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~lock.base=4174, ~lock.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5132-L5139] ensures true; VAL [#in~lock.base=4174, #in~lock.offset=0, #NULL.base=0, #NULL.offset=0, #res.base=4174, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~lock.base=4174, ~lock.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5885] RET call #t~ret152.base, #t~ret152.offset := spinlock_check(~ppp~2.base, 435 + ~ppp~2.offset); VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~ret152.base=4174, #t~ret152.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev~0.base=4113, ~dev~0.offset=-3264, ~hdr~0.base=4127, ~hdr~0.offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ppp~2.base=4174, ~ppp~2.offset=-435, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0, ~tmp~15.base=4174, ~tmp~15.offset=-435] [L5885] ~tmp___0~5.base, ~tmp___0~5.offset := #t~ret152.base, #t~ret152.offset; [L5885] havoc #t~ret152.base, #t~ret152.offset; [L5886] call #t~ret153 := _raw_spin_lock_irqsave(~tmp___0~5.base, ~tmp___0~5.offset); [L5886] ~flags~0 := #t~ret153; [L5886] havoc #t~ret153; [L5887] call #t~mem154 := read~int(~skb.base, 104 + ~skb.offset, 4); VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~mem154=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev~0.base=4113, ~dev~0.offset=-3264, ~hdr~0.base=4127, ~hdr~0.offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ppp~2.base=4174, ~ppp~2.offset=-435, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0, ~tmp___0~5.base=4174, ~tmp___0~5.offset=0, ~tmp~15.base=4174, ~tmp~15.offset=-435] [L5887-L5891] assume #t~mem154 % 4294967296 <= 3; [L5887] havoc #t~mem154; VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev~0.base=4113, ~dev~0.offset=-3264, ~hdr~0.base=4127, ~hdr~0.offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ppp~2.base=4174, ~ppp~2.offset=-435, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0, ~tmp___0~5.base=4174, ~tmp___0~5.offset=0, ~tmp~15.base=4174, ~tmp~15.offset=-435] [L5994] call #t~mem193 := read~int(~dev~0.base, 292 + ~dev~0.offset, 8); [L5994] call write~int(1 + #t~mem193, ~dev~0.base, 292 + ~dev~0.offset, 8); [L5994] havoc #t~mem193; VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev~0.base=4113, ~dev~0.offset=-3264, ~hdr~0.base=4127, ~hdr~0.offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ppp~2.base=4174, ~ppp~2.offset=-435, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0, ~tmp___0~5.base=4174, ~tmp___0~5.offset=0, ~tmp~15.base=4174, ~tmp~15.offset=-435] [L5996] CALL call spin_unlock_irqrestore(~ppp~2.base, 435 + ~ppp~2.offset, ~flags~0); VAL [#in~flags=4124, #in~lock.base=4174, #in~lock.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5140-L5148] ~lock.base, ~lock.offset := #in~lock.base, #in~lock.offset; [L5140-L5148] ~flags := #in~flags; [L5145] call _raw_spin_unlock_irqrestore(~lock.base, ~lock.offset, ~flags); VAL [#in~flags=4124, #in~lock.base=4174, #in~lock.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~flags=4124, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~lock.base=4174, ~lock.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5140-L5148] ensures true; VAL [#in~flags=4124, #in~lock.base=4174, #in~lock.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~flags=4124, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~lock.base=4174, ~lock.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5996] RET call spin_unlock_irqrestore(~ppp~2.base, 435 + ~ppp~2.offset, ~flags~0); VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev~0.base=4113, ~dev~0.offset=-3264, ~flags~0=4124, ~hdr~0.base=4127, ~hdr~0.offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ppp~2.base=4174, ~ppp~2.offset=-435, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0, ~tmp___0~5.base=4174, ~tmp___0~5.offset=0, ~tmp~15.base=4174, ~tmp~15.offset=-435] [L5997] CALL call dev_kfree_skb_any(~skb.base, ~skb.offset); VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5358-L5366] ~skb.base, ~skb.offset := #in~skb.base, #in~skb.offset; [L5363] call __dev_kfree_skb_any(~skb.base, ~skb.offset, 1); VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0] [L5358-L5366] ensures true; VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0] [L5997] RET call dev_kfree_skb_any(~skb.base, ~skb.offset); VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev~0.base=4113, ~dev~0.offset=-3264, ~flags~0=4124, ~hdr~0.base=4127, ~hdr~0.offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ppp~2.base=4174, ~ppp~2.offset=-435, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0, ~tmp___0~5.base=4174, ~tmp___0~5.offset=0, ~tmp~15.base=4174, ~tmp~15.offset=-435] [L5998] CALL call ppp_tx_flush(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5519] havoc ~skb~0.base, ~skb~0.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5526] CALL call #t~ret81.base, #t~ret81.offset := ldv_skb_dequeue_12(~#tx_queue~0.base, ~#tx_queue~0.offset); VAL [#in~ldv_func_arg1.base=4146, #in~ldv_func_arg1.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6623-L6631] ~ldv_func_arg1.base, ~ldv_func_arg1.offset := #in~ldv_func_arg1.base, #in~ldv_func_arg1.offset; [L6625] havoc ~tmp~21.base, ~tmp~21.offset; VAL [#in~ldv_func_arg1.base=4146, #in~ldv_func_arg1.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~ldv_func_arg1.base=4146, ~ldv_func_arg1.offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6628] CALL call #t~ret283.base, #t~ret283.offset := ldv_skb_alloc(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6839] havoc ~skb~2.base, ~skb~2.offset; [L6840] havoc ~tmp___7~3.base, ~tmp___7~3.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6843] CALL call #t~ret293.base, #t~ret293.offset := ldv_zalloc(248); VAL [#in~size=248, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1.base, ~p~1.offset; [L5256] havoc ~tmp~2.base, ~tmp~2.offset; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=248, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0] [L5261-L5268] assume !(0 != ~tmp___0~1); [L5264] call #t~malloc39.base, #t~malloc39.offset := #Ultimate.alloc((if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296)); VAL [#in~size=248, #NULL.base=0, #NULL.offset=0, #t~malloc39.base=1, #t~malloc39.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0] [L5264] CALL call #Ultimate.meminit(#t~malloc39.base, #t~malloc39.offset, 1, (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296), (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296)); VAL [#amountOfFields=1, #NULL.base=0, #NULL.offset=0, #product=248, #ptr.base=1, #ptr.offset=0, #sizeOfFields=248, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] #memory_int := ~initToZeroAtPointerBaseAddress~int(#memory_int, #ptr.base); VAL [#amountOfFields=1, #NULL.base=0, #NULL.offset=0, #product=248, #ptr.base=1, #ptr.offset=0, #sizeOfFields=248, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [?] ensures true; VAL [#amountOfFields=1, #NULL.base=0, #NULL.offset=0, #product=248, #ptr.base=1, #ptr.offset=0, #sizeOfFields=248, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5264] RET call #Ultimate.meminit(#t~malloc39.base, #t~malloc39.offset, 1, (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296), (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296)); VAL [#in~size=248, #NULL.base=0, #NULL.offset=0, #t~malloc39.base=1, #t~malloc39.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0] [L5264] ~tmp~2.base, ~tmp~2.offset := #t~malloc39.base, #t~malloc39.offset; [L5265] ~p~1.base, ~p~1.offset := ~tmp~2.base, ~tmp~2.offset; [L5266] assume 0 != (if 0 != (~p~1.base + ~p~1.offset) % 18446744073709551616 then 1 else 0); [L5267] #res.base, #res.offset := ~p~1.base, ~p~1.offset; VAL [#in~size=248, #NULL.base=0, #NULL.offset=0, #res.base=1, #res.offset=0, #t~malloc39.base=1, #t~malloc39.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~p~1.base=1, ~p~1.offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0, ~tmp~2.base=1, ~tmp~2.offset=0] [L5253-L5270] ensures true; VAL [#in~size=248, #NULL.base=0, #NULL.offset=0, #res.base=1, #res.offset=0, #t~malloc39.base=1, #t~malloc39.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~p~1.base=1, ~p~1.offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0, ~tmp~2.base=1, ~tmp~2.offset=0] [L6843] RET call #t~ret293.base, #t~ret293.offset := ldv_zalloc(248); VAL [#NULL.base=0, #NULL.offset=0, #t~ret293.base=1, #t~ret293.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6843] ~tmp___7~3.base, ~tmp___7~3.offset := #t~ret293.base, #t~ret293.offset; [L6843] havoc #t~ret293.base, #t~ret293.offset; [L6844] ~skb~2.base, ~skb~2.offset := ~tmp___7~3.base, ~tmp___7~3.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~2.base=1, ~skb~2.offset=0, ~tmp___7~3.base=1, ~tmp___7~3.offset=0] [L6845-L6850] assume !(~skb~2.base == 0 && ~skb~2.offset == 0); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~2.base=1, ~skb~2.offset=0, ~tmp___7~3.base=1, ~tmp___7~3.offset=0] [L6848] CALL call ldv_set_add(~LDV_SKBS~0.base, ~LDV_SKBS~0.offset, ~skb~2.base, ~skb~2.offset); VAL [#in~e.base=1, #in~e.offset=0, #in~set.base=0, #in~set.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6692-L6719] ~set.base, ~set.offset := #in~set.base, #in~set.offset; [L6692-L6719] ~e.base, ~e.offset := #in~e.base, #in~e.offset; [L6694] havoc ~i~1; [L6697] ~i~1 := 0; VAL [#in~e.base=1, #in~e.offset=0, #in~set.base=0, #in~set.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~e.base=1, ~e.offset=0, ~i~1=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~set.base=0, ~set.offset=0] [L6698-L6710] assume !false; VAL [#in~e.base=1, #in~e.offset=0, #in~set.base=0, #in~set.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~e.base=1, ~e.offset=0, ~i~1=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~set.base=0, ~set.offset=0] [L6699-L6703] assume !(~i~1 < ~last_index~0); VAL [#in~e.base=1, #in~e.offset=0, #in~set.base=0, #in~set.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~e.base=1, ~e.offset=0, ~i~1=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~set.base=0, ~set.offset=0] [L6711-L6716] assume ~last_index~0 < 15; [L6712] call write~$Pointer$(~e.base, ~e.offset, ~#set_impl~0.base, ~#set_impl~0.offset + 8 * ~last_index~0, 8); [L6713] ~last_index~0 := 1 + ~last_index~0; VAL [#in~e.base=1, #in~e.offset=0, #in~set.base=0, #in~set.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~e.base=1, ~e.offset=0, ~i~1=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~set.base=0, ~set.offset=0] [L6691] ensures true; VAL [#in~e.base=1, #in~e.offset=0, #in~set.base=0, #in~set.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~e.base=1, ~e.offset=0, ~i~1=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~set.base=0, ~set.offset=0] [L6848] RET call ldv_set_add(~LDV_SKBS~0.base, ~LDV_SKBS~0.offset, ~skb~2.base, ~skb~2.offset); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~2.base=1, ~skb~2.offset=0, ~tmp___7~3.base=1, ~tmp___7~3.offset=0] [L6849] #res.base, #res.offset := ~skb~2.base, ~skb~2.offset; VAL [#NULL.base=0, #NULL.offset=0, #res.base=1, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~2.base=1, ~skb~2.offset=0, ~tmp___7~3.base=1, ~tmp___7~3.offset=0] [L5225] ensures true; VAL [#NULL.base=0, #NULL.offset=0, #res.base=1, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~2.base=1, ~skb~2.offset=0, ~tmp___7~3.base=1, ~tmp___7~3.offset=0] [L6628] RET call #t~ret283.base, #t~ret283.offset := ldv_skb_alloc(); VAL [#in~ldv_func_arg1.base=4146, #in~ldv_func_arg1.offset=0, #NULL.base=0, #NULL.offset=0, #t~ret283.base=1, #t~ret283.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~ldv_func_arg1.base=4146, ~ldv_func_arg1.offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6628] ~tmp~21.base, ~tmp~21.offset := #t~ret283.base, #t~ret283.offset; [L6628] havoc #t~ret283.base, #t~ret283.offset; [L6629] #res.base, #res.offset := ~tmp~21.base, ~tmp~21.offset; VAL [#in~ldv_func_arg1.base=4146, #in~ldv_func_arg1.offset=0, #NULL.base=0, #NULL.offset=0, #res.base=1, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~ldv_func_arg1.base=4146, ~ldv_func_arg1.offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp~21.base=1, ~tmp~21.offset=0] [L5201] ensures true; VAL [#in~ldv_func_arg1.base=4146, #in~ldv_func_arg1.offset=0, #NULL.base=0, #NULL.offset=0, #res.base=1, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~ldv_func_arg1.base=4146, ~ldv_func_arg1.offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp~21.base=1, ~tmp~21.offset=0] [L5526] RET call #t~ret81.base, #t~ret81.offset := ldv_skb_dequeue_12(~#tx_queue~0.base, ~#tx_queue~0.offset); VAL [#NULL.base=0, #NULL.offset=0, #t~ret81.base=1, #t~ret81.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5526] ~skb~0.base, ~skb~0.offset := #t~ret81.base, #t~ret81.offset; [L5526] havoc #t~ret81.base, #t~ret81.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~0.base=1, ~skb~0.offset=0] [L5527-L5531] assume 0 != (~skb~0.base + ~skb~0.offset) % 18446744073709551616; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~0.base=1, ~skb~0.offset=0] [L5524] call #t~ret80 := dev_queue_xmit(~skb~0.base, ~skb~0.offset); [L5524] assume -2147483648 <= #t~ret80 && #t~ret80 <= 2147483647; [L5524] havoc #t~ret80; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~0.base=1, ~skb~0.offset=0] [L5526] CALL call #t~ret81.base, #t~ret81.offset := ldv_skb_dequeue_12(~#tx_queue~0.base, ~#tx_queue~0.offset); VAL [#in~ldv_func_arg1.base=4146, #in~ldv_func_arg1.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6623-L6631] ~ldv_func_arg1.base, ~ldv_func_arg1.offset := #in~ldv_func_arg1.base, #in~ldv_func_arg1.offset; [L6625] havoc ~tmp~21.base, ~tmp~21.offset; VAL [#in~ldv_func_arg1.base=4146, #in~ldv_func_arg1.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~ldv_func_arg1.base=4146, ~ldv_func_arg1.offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6628] CALL call #t~ret283.base, #t~ret283.offset := ldv_skb_alloc(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6839] havoc ~skb~2.base, ~skb~2.offset; [L6840] havoc ~tmp___7~3.base, ~tmp___7~3.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6843] CALL call #t~ret293.base, #t~ret293.offset := ldv_zalloc(248); VAL [#in~size=248, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1.base, ~p~1.offset; [L5256] havoc ~tmp~2.base, ~tmp~2.offset; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=248, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=1] [L5261-L5268] assume 0 != ~tmp___0~1; [L5262] #res.base, #res.offset := 0, 0; VAL [#in~size=248, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=1] [L5253-L5270] ensures true; VAL [#in~size=248, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=1] [L6843] RET call #t~ret293.base, #t~ret293.offset := ldv_zalloc(248); VAL [#NULL.base=0, #NULL.offset=0, #t~ret293.base=0, #t~ret293.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6843] ~tmp___7~3.base, ~tmp___7~3.offset := #t~ret293.base, #t~ret293.offset; [L6843] havoc #t~ret293.base, #t~ret293.offset; [L6844] ~skb~2.base, ~skb~2.offset := ~tmp___7~3.base, ~tmp___7~3.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~2.base=0, ~skb~2.offset=0, ~tmp___7~3.base=0, ~tmp___7~3.offset=0] [L6845-L6850] assume ~skb~2.base == 0 && ~skb~2.offset == 0; [L6846] #res.base, #res.offset := 0, 0; VAL [#NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~2.base=0, ~skb~2.offset=0, ~tmp___7~3.base=0, ~tmp___7~3.offset=0] [L5225] ensures true; VAL [#NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~2.base=0, ~skb~2.offset=0, ~tmp___7~3.base=0, ~tmp___7~3.offset=0] [L6628] RET call #t~ret283.base, #t~ret283.offset := ldv_skb_alloc(); VAL [#in~ldv_func_arg1.base=4146, #in~ldv_func_arg1.offset=0, #NULL.base=0, #NULL.offset=0, #t~ret283.base=0, #t~ret283.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~ldv_func_arg1.base=4146, ~ldv_func_arg1.offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6628] ~tmp~21.base, ~tmp~21.offset := #t~ret283.base, #t~ret283.offset; [L6628] havoc #t~ret283.base, #t~ret283.offset; [L6629] #res.base, #res.offset := ~tmp~21.base, ~tmp~21.offset; VAL [#in~ldv_func_arg1.base=4146, #in~ldv_func_arg1.offset=0, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~ldv_func_arg1.base=4146, ~ldv_func_arg1.offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp~21.base=0, ~tmp~21.offset=0] [L5201] ensures true; VAL [#in~ldv_func_arg1.base=4146, #in~ldv_func_arg1.offset=0, #NULL.base=0, #NULL.offset=0, #res.base=0, #res.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~ldv_func_arg1.base=4146, ~ldv_func_arg1.offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp~21.base=0, ~tmp~21.offset=0] [L5526] RET call #t~ret81.base, #t~ret81.offset := ldv_skb_dequeue_12(~#tx_queue~0.base, ~#tx_queue~0.offset); VAL [#NULL.base=0, #NULL.offset=0, #t~ret81.base=0, #t~ret81.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~0.base=1, ~skb~0.offset=0] [L5526] ~skb~0.base, ~skb~0.offset := #t~ret81.base, #t~ret81.offset; [L5526] havoc #t~ret81.base, #t~ret81.offset; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~0.base=0, ~skb~0.offset=0] [L5527-L5531] assume !(0 != (~skb~0.base + ~skb~0.offset) % 18446744073709551616); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~0.base=0, ~skb~0.offset=0] [L5517-L5535] ensures true; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb~0.base=0, ~skb~0.offset=0] [L5998] RET call ppp_tx_flush(); VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev~0.base=4113, ~dev~0.offset=-3264, ~flags~0=4124, ~hdr~0.base=4127, ~hdr~0.offset=4157, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ppp~2.base=4174, ~ppp~2.offset=-435, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0, ~tmp___0~5.base=4174, ~tmp___0~5.offset=0, ~tmp~15.base=4174, ~tmp~15.offset=-435] [L5999] #res := 1; VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #res=1, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev~0.base=4113, ~dev~0.offset=-3264, ~flags~0=4124, ~hdr~0.base=4127, ~hdr~0.offset=4157, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ppp~2.base=4174, ~ppp~2.offset=-435, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0, ~tmp___0~5.base=4174, ~tmp___0~5.offset=0, ~tmp~15.base=4174, ~tmp~15.offset=-435] [L5863-L6001] ensures true; VAL [#in~skb.base=0, #in~skb.offset=0, #NULL.base=0, #NULL.offset=0, #res=1, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~dev~0.base=4113, ~dev~0.offset=-3264, ~flags~0=4124, ~hdr~0.base=4127, ~hdr~0.offset=4157, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ppp~2.base=4174, ~ppp~2.offset=-435, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~skb.base=0, ~skb.offset=0, ~tmp___0~5.base=4174, ~tmp___0~5.offset=0, ~tmp~15.base=4174, ~tmp~15.offset=-435] [L6461] RET call #t~ret270 := ppp_rx(~proto_group0~0.base, ~proto_group0~0.offset); VAL [#NULL.base=0, #NULL.offset=0, #t~ret270=1, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6461] assume -2147483648 <= #t~ret270 && #t~ret270 <= 2147483647; [L6461] havoc #t~ret270; [L6462] ~ldv_state_variable_3~0 := 1; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6466-L6471] assume !(3 == ~ldv_state_variable_3~0); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6472-L6477] assume !(2 == ~ldv_state_variable_3~0); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6478-L6483] assume !(5 == ~ldv_state_variable_3~0); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6318] assume -2147483648 <= #t~nondet252 && #t~nondet252 <= 2147483647; [L6318] ~tmp___6~1 := #t~nondet252; [L6318] havoc #t~nondet252; [L6320] #t~switch253 := 0 == ~tmp___6~1; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=false, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6320] assume !#t~switch253; [L6327] #t~switch253 := #t~switch253 || 1 == ~tmp___6~1; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6327] assume #t~switch253; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6328-L6367] assume 0 != ~ldv_state_variable_0~0; [L6329] assume -2147483648 <= #t~nondet254 && #t~nondet254 <= 2147483647; [L6329] ~tmp___7~1 := #t~nondet254; [L6329] havoc #t~nondet254; [L6331] #t~switch255 := 0 == ~tmp___7~1; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6331] assume #t~switch255; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6332-L6338] assume 3 == ~ldv_state_variable_0~0 && 0 == ~ref_cnt~0; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6333] CALL call mod_exit(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6193] call unregister_hdlc_protocol(~#proto~0.base, ~#proto~0.offset); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6188-L6196] ensures true; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6333] RET call mod_exit(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6334] ~ldv_state_variable_0~0 := 2; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0.base=0, ~ldvarg0~0.offset=0, ~ldvarg1~0=4110, ~ldvarg2~0.base=0, ~ldvarg2~0.offset=0, ~ldvarg3~0.base=0, ~ldvarg3~0.offset=0, ~ldvarg4~0=4173, ~ldvarg5~0.base=0, ~ldvarg5~0.offset=0, ~ldvarg6~0.base=0, ~ldvarg6~0.offset=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5.base=0, ~tmp___2~5.offset=0, ~tmp___3~2.base=0, ~tmp___3~2.offset=0, ~tmp___4~3.base=0, ~tmp___4~3.offset=0, ~tmp___5~1.base=0, ~tmp___5~1.offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20.base=0, ~tmp~20.offset=0] [L6574] CALL call ldv_check_final_state(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6916] havoc ~tmp___7~7; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6919] CALL call #t~ret297 := ldv_set_is_empty(~LDV_SKBS~0.base, ~LDV_SKBS~0.offset); VAL [#in~set.base=0, #in~set.offset=0, #NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6785-L6792] ~set.base, ~set.offset := #in~set.base, #in~set.offset; [L6790] #res := (if 0 == ~last_index~0 then 1 else 0); VAL [#in~set.base=0, #in~set.offset=0, #NULL.base=0, #NULL.offset=0, #res=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~set.base=0, ~set.offset=0] [L6784] ensures true; VAL [#in~set.base=0, #in~set.offset=0, #NULL.base=0, #NULL.offset=0, #res=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~set.base=0, ~set.offset=0] [L6919] RET call #t~ret297 := ldv_set_is_empty(~LDV_SKBS~0.base, ~LDV_SKBS~0.offset); VAL [#NULL.base=0, #NULL.offset=0, #t~ret297=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L6919] assume -2147483648 <= #t~ret297 && #t~ret297 <= 2147483647; [L6919] ~tmp___7~7 := #t~ret297; [L6919] havoc #t~ret297; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___7~7=0] [L6920-L6924] assume !(0 != ~tmp___7~7); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0, ~tmp___7~7=0] [L6923] CALL call ldv_error(); VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] [L5304] assert false; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0.base)=0, old(~ldv_timer_list_1~0.offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0.base)=0, old(~proto_group0~0.offset)=0, old(~proto_group1~0.base)=0, old(~proto_group1~0.offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] ----- ----- class de.uni_freiburg.informatik.ultimate.boogie.preprocessor.BoogiePreprocessorBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL.base=4128, #NULL.offset=4164, #t~string114.base=4136, #t~string114.offset=4161, #t~string121.base=4106, #t~string121.offset=4144, #t~string211.base=4166, #t~string211.offset=4109, #t~string22.base=4176, #t~string22.offset=4143, #t~string237.base=4115, #t~string237.offset=4138, #t~string64.base=4172, #t~string64.offset=4155, #t~string65.base=4153, #t~string65.offset=4180, #t~string66.base=4150, #t~string66.offset=4103, #t~string84.base=4158, #t~string84.offset=4112, old(#NULL.base)=4128, old(#NULL.offset)=4164, old(#t~string114.base)=4136, old(#t~string114.offset)=4161, old(#t~string121.base)=4106, old(#t~string121.offset)=4144, old(#t~string211.base)=4166, old(#t~string211.offset)=4109, old(#t~string22.base)=4176, old(#t~string22.offset)=4143, old(#t~string237.base)=4115, old(#t~string237.offset)=4138, old(#t~string64.base)=4172, old(#t~string64.offset)=4155, old(#t~string65.base)=4153, old(#t~string65.offset)=4180, old(#t~string66.base)=4150, old(#t~string66.offset)=4103, old(#t~string84.base)=4158, old(#t~string84.offset)=4112, old(~#cp_table~0.base)=4118, old(~#cp_table~0.offset)=4140, old(~#ppp_header_ops~0.base)=4131, old(~#ppp_header_ops~0.offset)=4126, old(~#proto~0.base)=4137, old(~#proto~0.offset)=4152, old(~#set_impl~0.base)=4168, old(~#set_impl~0.offset)=4123, old(~#tx_queue~0.base)=4159, old(~#tx_queue~0.offset)=4117, old(~last_index~0)=4160, old(~LDV_IN_INTERRUPT~0)=4120, old(~ldv_retval_0~0)=4116, old(~LDV_SKBS~0.base)=4104, old(~LDV_SKBS~0.offset)=4125, old(~ldv_state_variable_0~0)=4129, old(~ldv_state_variable_1~0)=4162, old(~ldv_state_variable_2~0)=4149, old(~ldv_state_variable_3~0)=4179, old(~ldv_timer_list_1~0.base)=4169, old(~ldv_timer_list_1~0.offset)=4170, old(~ldv_timer_state_1~0)=4177, old(~proto_group0~0.base)=4141, old(~proto_group0~0.offset)=4145, old(~proto_group1~0.base)=4122, old(~proto_group1~0.offset)=4134, old(~ref_cnt~0)=4147, ~#cp_table~0.base=4118, ~#cp_table~0.offset=4140, ~#ppp_header_ops~0.base=4131, ~#ppp_header_ops~0.offset=4126, ~#proto~0.base=4137, ~#proto~0.offset=4152, ~#set_impl~0.base=4168, ~#set_impl~0.offset=4123, ~#tx_queue~0.base=4159, ~#tx_queue~0.offset=4117, ~last_index~0=4160, ~LDV_IN_INTERRUPT~0=4120, ~ldv_retval_0~0=4116, ~LDV_SKBS~0.base=4104, ~LDV_SKBS~0.offset=4125, ~ldv_state_variable_0~0=4129, ~ldv_state_variable_1~0=4162, ~ldv_state_variable_2~0=4149, ~ldv_state_variable_3~0=4179, ~ldv_timer_list_1~0.base=4169, ~ldv_timer_list_1~0.offset=4170, ~ldv_timer_state_1~0=4177, ~proto_group0~0.base=4141, ~proto_group0~0.offset=4145, ~proto_group1~0.base=4122, ~proto_group1~0.offset=4134, ~ref_cnt~0=4147] [?] #NULL.base, #NULL.offset := 0, 0; [?] #valid := #valid[0 := 0]; [L5195] call #t~string22.base, #t~string22.offset := #Ultimate.alloc(22); [L5448] call #t~string64.base, #t~string64.offset := #Ultimate.alloc(4); [L5448] call write~init~int(76, #t~string64.base, #t~string64.offset, 1); [L5448] call write~init~int(67, #t~string64.base, 1 + #t~string64.offset, 1); [L5448] call write~init~int(80, #t~string64.base, 2 + #t~string64.offset, 1); [L5448] call write~init~int(0, #t~string64.base, 3 + #t~string64.offset, 1); [L5450] call #t~string65.base, #t~string65.offset := #Ultimate.alloc(5); [L5450] call write~init~int(73, #t~string65.base, #t~string65.offset, 1); [L5450] call write~init~int(80, #t~string65.base, 1 + #t~string65.offset, 1); [L5450] call write~init~int(67, #t~string65.base, 2 + #t~string65.offset, 1); [L5450] call write~init~int(80, #t~string65.base, 3 + #t~string65.offset, 1); [L5450] call write~init~int(0, #t~string65.base, 4 + #t~string65.offset, 1); [L5452] call #t~string66.base, #t~string66.offset := #Ultimate.alloc(7); [L5452] call write~init~int(73, #t~string66.base, #t~string66.offset, 1); [L5452] call write~init~int(80, #t~string66.base, 1 + #t~string66.offset, 1); [L5452] call write~init~int(86, #t~string66.base, 2 + #t~string66.offset, 1); [L5452] call write~init~int(54, #t~string66.base, 3 + #t~string66.offset, 1); [L5452] call write~init~int(67, #t~string66.base, 4 + #t~string66.offset, 1); [L5452] call write~init~int(80, #t~string66.base, 5 + #t~string66.offset, 1); [L5452] call write~init~int(0, #t~string66.base, 6 + #t~string66.offset, 1); [L5561] call #t~string84.base, #t~string84.offset := #Ultimate.alloc(30); [L5719] call #t~string114.base, #t~string114.offset := #Ultimate.alloc(7); [L5719] call write~init~int(37, #t~string114.base, #t~string114.offset, 1); [L5719] call write~init~int(115, #t~string114.base, 1 + #t~string114.offset, 1); [L5719] call write~init~int(32, #t~string114.base, 2 + #t~string114.offset, 1); [L5719] call write~init~int(117, #t~string114.base, 3 + #t~string114.offset, 1); [L5719] call write~init~int(112, #t~string114.base, 4 + #t~string114.offset, 1); [L5719] call write~init~int(10, #t~string114.base, 5 + #t~string114.offset, 1); [L5719] call write~init~int(0, #t~string114.base, 6 + #t~string114.offset, 1); [L5736] call #t~string121.base, #t~string121.offset := #Ultimate.alloc(9); [L6035] call #t~string211.base, #t~string211.offset := #Ultimate.alloc(11); [L6163] call #t~string237.base, #t~string237.offset := #Ultimate.alloc(21); [L5333] ~LDV_IN_INTERRUPT~0 := 1; [L5335] ~ldv_state_variable_0~0 := 0; [L5336] ~ldv_state_variable_3~0 := 0; [L5337] ~ldv_timer_state_1~0 := 0; [L5338] ~ldv_state_variable_2~0 := 0; [L5340] ~ref_cnt~0 := 0; [L5341] ~ldv_state_variable_1~0 := 0; [L5595-L5621] call ~#cp_table~0.base, ~#cp_table~0.offset := #Ultimate.alloc(364); [L5595-L5621] call write~init~int(163, ~#cp_table~0.base, ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 4 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 8 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 12 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 16 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 20 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 24 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 28 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 32 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 36 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 40 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 44 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 48 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 52 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 56 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 60 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1026, ~#cp_table~0.base, 64 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 68 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 72 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(133, ~#cp_table~0.base, 76 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 80 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 84 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 88 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 92 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 96 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 100 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 104 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(16, ~#cp_table~0.base, 108 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2048, ~#cp_table~0.base, 112 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(421, ~#cp_table~0.base, 116 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2, ~#cp_table~0.base, 120 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(261, ~#cp_table~0.base, 124 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(262, ~#cp_table~0.base, 128 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(261, ~#cp_table~0.base, 132 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(389, ~#cp_table~0.base, 136 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2048, ~#cp_table~0.base, 140 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(675, ~#cp_table~0.base, 144 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2, ~#cp_table~0.base, 148 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(515, ~#cp_table~0.base, 152 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(516, ~#cp_table~0.base, 156 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(515, ~#cp_table~0.base, 160 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(643, ~#cp_table~0.base, 164 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2048, ~#cp_table~0.base, 168 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2049, ~#cp_table~0.base, 172 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2, ~#cp_table~0.base, 176 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(36, ~#cp_table~0.base, 180 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 184 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(6, ~#cp_table~0.base, 188 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 192 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2048, ~#cp_table~0.base, 196 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2049, ~#cp_table~0.base, 200 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2, ~#cp_table~0.base, 204 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(163, ~#cp_table~0.base, 208 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 212 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(165, ~#cp_table~0.base, 216 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 220 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2048, ~#cp_table~0.base, 224 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2049, ~#cp_table~0.base, 228 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2050, ~#cp_table~0.base, 232 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2051, ~#cp_table~0.base, 236 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2051, ~#cp_table~0.base, 240 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2051, ~#cp_table~0.base, 244 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2114, ~#cp_table~0.base, 248 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 252 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 256 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 260 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(3, ~#cp_table~0.base, 264 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(3, ~#cp_table~0.base, 268 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(5, ~#cp_table~0.base, 272 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(131, ~#cp_table~0.base, 276 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4096, ~#cp_table~0.base, 280 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4097, ~#cp_table~0.base, 284 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4098, ~#cp_table~0.base, 288 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4099, ~#cp_table~0.base, 292 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4100, ~#cp_table~0.base, 296 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4101, ~#cp_table~0.base, 300 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(4102, ~#cp_table~0.base, 304 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 308 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 312 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(2, ~#cp_table~0.base, 316 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(3, ~#cp_table~0.base, 320 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(3, ~#cp_table~0.base, 324 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(5, ~#cp_table~0.base, 328 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(6, ~#cp_table~0.base, 332 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(0, ~#cp_table~0.base, 336 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 340 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 344 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 348 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 352 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1, ~#cp_table~0.base, 356 + ~#cp_table~0.offset, 4); [L5595-L5621] call write~init~int(1058, ~#cp_table~0.base, 360 + ~#cp_table~0.offset, 4); [L6197] ~ldv_retval_0~0 := 0; [L6679] ~last_index~0 := 0; [L5334] ~proto_group1~0.base, ~proto_group1~0.offset := 0, 0; [L5339] ~proto_group0~0.base, ~proto_group0~0.offset := 0, 0; [L5342] ~ldv_timer_list_1~0.base, ~ldv_timer_list_1~0.offset := 0, 0; [L5410] call ~#tx_queue~0.base, ~#tx_queue~0.offset := #Ultimate.alloc(88); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, ~#tx_queue~0.offset, 8); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 8 + ~#tx_queue~0.offset, 8); [L5410] call write~init~int(0, ~#tx_queue~0.base, 16 + ~#tx_queue~0.offset, 4); [L5410] call write~init~int(0, ~#tx_queue~0.base, 20 + ~#tx_queue~0.offset, 4); [L5410] call write~init~int(0, ~#tx_queue~0.base, 24 + ~#tx_queue~0.offset, 4); [L5410] call write~init~int(0, ~#tx_queue~0.base, 28 + ~#tx_queue~0.offset, 4); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 32 + ~#tx_queue~0.offset, 8); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 40 + ~#tx_queue~0.offset, 8); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 48 + ~#tx_queue~0.offset, 8); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 56 + ~#tx_queue~0.offset, 8); [L5410] call write~init~$Pointer$(0, 0, ~#tx_queue~0.base, 64 + ~#tx_queue~0.offset, 8); [L5410] call write~init~int(0, ~#tx_queue~0.base, 72 + ~#tx_queue~0.offset, 4); [L5410] call write~init~int(0, ~#tx_queue~0.base, 76 + ~#tx_queue~0.offset, 8); [L6104-L6106] call ~#proto~0.base, ~#proto~0.offset := #Ultimate.alloc(88); [L6104-L6106] call write~init~$Pointer$(0, 0, ~#proto~0.base, ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(#funAddr~ppp_close.base, #funAddr~ppp_close.offset, ~#proto~0.base, 8 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(#funAddr~ppp_start.base, #funAddr~ppp_start.offset, ~#proto~0.base, 16 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(#funAddr~ppp_stop.base, #funAddr~ppp_stop.offset, ~#proto~0.base, 24 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(0, 0, ~#proto~0.base, 32 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(#funAddr~ppp_ioctl.base, #funAddr~ppp_ioctl.offset, ~#proto~0.base, 40 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(#funAddr~ppp_type_trans.base, #funAddr~ppp_type_trans.offset, ~#proto~0.base, 48 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(#funAddr~ppp_rx.base, #funAddr~ppp_rx.offset, ~#proto~0.base, 56 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(0, 0, ~#proto~0.base, 64 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(~#__this_module~0.base, ~#__this_module~0.offset, ~#proto~0.base, 72 + ~#proto~0.offset, 8); [L6104-L6106] call write~init~$Pointer$(0, 0, ~#proto~0.base, 80 + ~#proto~0.offset, 8); [L6107] call ~#ppp_header_ops~0.base, ~#ppp_header_ops~0.offset := #Ultimate.alloc(40); [L6107] call write~init~$Pointer$(#funAddr~ppp_hard_header.base, #funAddr~ppp_hard_header.offset, ~#ppp_header_ops~0.base, ~#ppp_header_ops~0.offset, 8); [L6107] call write~init~$Pointer$(0, 0, ~#ppp_header_ops~0.base, 8 + ~#ppp_header_ops~0.offset, 8); [L6107] call write~init~$Pointer$(0, 0, ~#ppp_header_ops~0.base, 16 + ~#ppp_header_ops~0.offset, 8); [L6107] call write~init~$Pointer$(0, 0, ~#ppp_header_ops~0.base, 24 + ~#ppp_header_ops~0.offset, 8); [L6107] call write~init~$Pointer$(0, 0, ~#ppp_header_ops~0.base, 32 + ~#ppp_header_ops~0.offset, 8); [L6678] call ~#set_impl~0.base, ~#set_impl~0.offset := #Ultimate.alloc(120); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 8 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 16 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 24 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 32 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 40 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 48 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 56 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 64 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 72 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 80 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 88 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 96 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 104 + ~#set_impl~0.offset, 8); [L6678] call write~init~$Pointer$(0, 0, ~#set_impl~0.base, 112 + ~#set_impl~0.offset, 8); [L6836] ~LDV_SKBS~0.base, ~LDV_SKBS~0.offset := 0, 0; VAL [#NULL.base=0, #NULL.offset=0, #t~string114.base=4135, #t~string114.offset=0, #t~string121.base=4107, #t~string121.offset=0, #t~string211.base=4165, #t~string211.offset=0, #t~string22.base=4175, #t~string22.offset=0, #t~string237.base=4114, #t~string237.offset=0, #t~string64.base=4171, #t~string64.offset=0, #t~string65.base=4154, #t~string65.offset=0, #t~string66.base=4151, #t~string66.offset=0, #t~string84.base=4163, #t~string84.offset=0, old(#NULL.base)=4128, old(#NULL.offset)=4164, old(#t~string114.base)=4136, old(#t~string114.offset)=4161, old(#t~string121.base)=4106, old(#t~string121.offset)=4144, old(#t~string211.base)=4166, old(#t~string211.offset)=4109, old(#t~string22.base)=4176, old(#t~string22.offset)=4143, old(#t~string237.base)=4115, old(#t~string237.offset)=4138, old(#t~string64.base)=4172, old(#t~string64.offset)=4155, old(#t~string65.base)=4153, old(#t~string65.offset)=4180, old(#t~string66.base)=4150, old(#t~string66.offset)=4103, old(#t~string84.base)=4158, old(#t~string84.offset)=4112, old(~#cp_table~0.base)=4118, old(~#cp_table~0.offset)=4140, old(~#ppp_header_ops~0.base)=4131, old(~#ppp_header_ops~0.offset)=4126, old(~#proto~0.base)=4137, old(~#proto~0.offset)=4152, old(~#set_impl~0.base)=4168, old(~#set_impl~0.offset)=4123, old(~#tx_queue~0.base)=4159, old(~#tx_queue~0.offset)=4117, old(~last_index~0)=4160, old(~LDV_IN_INTERRUPT~0)=4120, old(~ldv_retval_0~0)=4116, old(~LDV_SKBS~0.base)=4104, old(~LDV_SKBS~0.offset)=4125, old(~ldv_state_variable_0~0)=4129, old(~ldv_state_variable_1~0)=4162, old(~ldv_state_variable_2~0)=4149, old(~ldv_state_variable_3~0)=4179, old(~ldv_timer_list_1~0.base)=4169, old(~ldv_timer_list_1~0.offset)=4170, old(~ldv_timer_state_1~0)=4177, old(~proto_group0~0.base)=4141, old(~proto_group0~0.offset)=4145, old(~proto_group1~0.base)=4122, old(~proto_group1~0.offset)=4134, old(~ref_cnt~0)=4147, ~#__this_module~0.base=4178, ~#__this_module~0.offset=4142, ~#cp_table~0.base=4119, ~#cp_table~0.offset=0, ~#ppp_header_ops~0.base=4133, ~#ppp_header_ops~0.offset=0, ~#proto~0.base=4139, ~#proto~0.offset=0, ~#set_impl~0.base=4156, ~#set_impl~0.offset=0, ~#tx_queue~0.base=4146, ~#tx_queue~0.offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0.base=0, ~LDV_SKBS~0.offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0.base=0, ~ldv_timer_list_1~0.offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0.base=0, ~proto_group0~0.offset=0, ~proto_group1~0.base=0, ~proto_group1~0.offset=0, ~ref_cnt~0=0] WARNING: YOUR LOGFILE WAS TOO LONG, SOME LINES IN THE MIDDLE WERE REMOVED. [L6307] ~tmp___4~3 := #t~ret250; [L6307] havoc #t~ret250; [L6308] ~ldvarg2~0 := ~tmp___4~3; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6309] CALL call #t~ret251 := ldv_zalloc(1); VAL [#in~size=1, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=1, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=1, ~tmp___0~1=1] [L5261] COND TRUE 0 != ~tmp___0~1 [L5262] #res := { base: 0, offset: 0 }; VAL [#in~size=1, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=1, ~tmp___0~1=1] [L6309] RET call #t~ret251 := ldv_zalloc(1); VAL [#NULL!base=0, #NULL!offset=0, #t~ret251!base=0, #t~ret251!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6309] ~tmp___5~1 := #t~ret251; [L6309] havoc #t~ret251; [L6310] ~ldvarg6~0 := ~tmp___5~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6311] CALL call ldv_initialize(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6858] CALL call ldv_set_init(~LDV_SKBS~0); VAL [#in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6681-L6690] ~set := #in~set; [L6686] ~set := ~#set_impl~0; [L6687] ~last_index~0 := 0; VAL [#in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~set!base=4156, ~set!offset=0] [L6858] RET call ldv_set_init(~LDV_SKBS~0); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6311] RET call ldv_initialize(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6312] ~ldv_state_variable_1~0 := 1; [L6313] ~ref_cnt~0 := 0; [L6314] ~ldv_state_variable_0~0 := 1; [L6315] ~ldv_state_variable_3~0 := 0; [L6316] ~ldv_state_variable_2~0 := 0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6318] assume -2147483648 <= #t~nondet252 && #t~nondet252 <= 2147483647; [L6318] ~tmp___6~1 := #t~nondet252; [L6318] havoc #t~nondet252; [L6320] #t~switch253 := 0 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND FALSE !(#t~switch253) [L6327] #t~switch253 := #t~switch253 || 1 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND TRUE #t~switch253 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6328] COND TRUE 0 != ~ldv_state_variable_0~0 [L6329] assume -2147483648 <= #t~nondet254 && #t~nondet254 <= 2147483647; [L6329] ~tmp___7~1 := #t~nondet254; [L6329] havoc #t~nondet254; [L6331] #t~switch255 := 0 == ~tmp___7~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6330-L6363] COND FALSE !(#t~switch255) [L6340] #t~switch255 := #t~switch255 || 1 == ~tmp___7~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6330-L6363] COND TRUE #t~switch255 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6341] COND TRUE 1 == ~ldv_state_variable_0~0 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6342] CALL call #t~ret256 := mod_init(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6183] CALL call skb_queue_head_init(~#tx_queue~0); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5189-L5199] ~list := #in~list; [L5191] FCALL call ~#__key~0 := #Ultimate.alloc(8); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__key~0!base=4167, ~#__key~0!offset=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~list!base=4146, ~list!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5194] CALL call #t~ret21 := spinlock_check({ base: ~list!base, offset: 20 + ~list!offset }); VAL [#in~lock!base=4146, #in~lock!offset=20, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5132-L5139] ~lock := #in~lock; [L5137] #res := { base: ~lock!base, offset: ~lock!offset }; VAL [#in~lock!base=4146, #in~lock!offset=20, #NULL!base=0, #NULL!offset=0, #res!base=4146, #res!offset=20, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~lock!base=4146, ~lock!offset=20, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5194] RET call #t~ret21 := spinlock_check({ base: ~list!base, offset: 20 + ~list!offset }); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~ret21!base=4146, #t~ret21!offset=20, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__key~0!base=4167, ~#__key~0!offset=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~list!base=4146, ~list!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5194] havoc #t~ret21; [L5195] FCALL call __raw_spin_lock_init({ base: ~list!base, offset: 20 + ~list!offset }, #t~string22, ~#__key~0); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__key~0!base=4167, ~#__key~0!offset=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~list!base=4146, ~list!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5196] CALL call __skb_queue_head_init(~list); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5177-L5188] ~list := #in~list; [L5179] havoc ~tmp~0; [L5182] ~tmp~0 := ~list; [L5183] FCALL call write~$Pointer$(~tmp~0, { base: ~list!base, offset: ~list!offset }, 8); [L5184] FCALL call write~$Pointer$(~tmp~0, { base: ~list!base, offset: 8 + ~list!offset }, 8); [L5185] FCALL call write~int(0, { base: ~list!base, offset: 16 + ~list!offset }, 4); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~list!base=4146, ~list!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~0!base=4146, ~tmp~0!offset=0] [L5196] RET call __skb_queue_head_init(~list); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__key~0!base=4167, ~#__key~0!offset=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~list!base=4146, ~list!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5191] FCALL call ULTIMATE.dealloc(~#__key~0); [L5197] havoc ~#__key~0; VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~list!base=4146, ~list!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6183] RET call skb_queue_head_init(~#tx_queue~0); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6184] FCALL call register_hdlc_protocol(~#proto~0); [L6185] #res := 0; VAL [#NULL!base=0, #NULL!offset=0, #res=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6342] RET call #t~ret256 := mod_init(); VAL [#NULL!base=0, #NULL!offset=0, #t~ret256=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6342] assume -2147483648 <= #t~ret256 && #t~ret256 <= 2147483647; [L6342] ~ldv_retval_0~0 := #t~ret256; [L6342] havoc #t~ret256; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6343] COND TRUE 0 == ~ldv_retval_0~0 [L6344] ~ldv_state_variable_0~0 := 3; [L6345] ~ldv_state_variable_2~0 := 1; [L6346] ~ldv_state_variable_3~0 := 1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6347] CALL call ldv_initialize_hdlc_proto_3(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6228] havoc ~tmp~19; [L6229] havoc ~tmp___0~8; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6232] CALL call #t~ret239 := ldv_zalloc(3264); VAL [#in~size=3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=3264, ~tmp___0~1=1] [L5261] COND TRUE 0 != ~tmp___0~1 [L5262] #res := { base: 0, offset: 0 }; VAL [#in~size=3264, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=3264, ~tmp___0~1=1] [L6232] RET call #t~ret239 := ldv_zalloc(3264); VAL [#NULL!base=0, #NULL!offset=0, #t~ret239!base=0, #t~ret239!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6232] ~tmp~19 := #t~ret239; [L6232] havoc #t~ret239; [L6233] ~proto_group1~0 := ~tmp~19; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~19!base=0, ~tmp~19!offset=0] [L6234] CALL call #t~ret240 := ldv_zalloc(232); VAL [#in~size=232, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=232, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=232, ~tmp___0~1=1] [L5261] COND TRUE 0 != ~tmp___0~1 [L5262] #res := { base: 0, offset: 0 }; VAL [#in~size=232, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=232, ~tmp___0~1=1] [L6234] RET call #t~ret240 := ldv_zalloc(232); VAL [#NULL!base=0, #NULL!offset=0, #t~ret240!base=0, #t~ret240!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~19!base=0, ~tmp~19!offset=0] [L6234] ~tmp___0~8 := #t~ret240; [L6234] havoc #t~ret240; [L6235] ~proto_group0~0 := ~tmp___0~8; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~8!base=0, ~tmp___0~8!offset=0, ~tmp~19!base=0, ~tmp~19!offset=0] [L6347] RET call ldv_initialize_hdlc_proto_3(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6351] COND FALSE !(0 != ~ldv_retval_0~0) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6318] assume -2147483648 <= #t~nondet252 && #t~nondet252 <= 2147483647; [L6318] ~tmp___6~1 := #t~nondet252; [L6318] havoc #t~nondet252; [L6320] #t~switch253 := 0 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=false, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND FALSE !(#t~switch253) [L6327] #t~switch253 := #t~switch253 || 1 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=false, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND FALSE !(#t~switch253) [L6369] #t~switch253 := #t~switch253 || 2 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND TRUE #t~switch253 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6370] COND TRUE 0 != ~ldv_state_variable_3~0 [L6371] assume -2147483648 <= #t~nondet257 && #t~nondet257 <= 2147483647; [L6371] ~tmp___8~0 := #t~nondet257; [L6371] havoc #t~nondet257; [L6373] #t~switch258 := 0 == ~tmp___8~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6372-L6541] COND FALSE !(#t~switch258) [L6381] #t~switch258 := #t~switch258 || 1 == ~tmp___8~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6372-L6541] COND FALSE !(#t~switch258) [L6413] #t~switch258 := #t~switch258 || 2 == ~tmp___8~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6372-L6541] COND FALSE !(#t~switch258) [L6445] #t~switch258 := #t~switch258 || 3 == ~tmp___8~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6372-L6541] COND FALSE !(#t~switch258) [L6453] #t~switch258 := #t~switch258 || 4 == ~tmp___8~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6372-L6541] COND TRUE #t~switch258 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6454] COND FALSE !(4 == ~ldv_state_variable_3~0) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6460] COND TRUE 1 == ~ldv_state_variable_3~0 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6461] CALL call #t~ret270 := ppp_rx(~proto_group0~0); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5863-L6001] ~skb := #in~skb; [L5865] havoc ~hdr~0; [L5866] havoc ~dev~0; [L5867] havoc ~ppp~2; [L5868] havoc ~tmp~15; [L5869] havoc ~proto___0~1; [L5870] havoc ~cp~1; [L5871] havoc ~flags~0; [L5872] havoc ~len~1; [L5873] havoc ~pid~0; [L5874] havoc ~tmp___0~5; [L5875] havoc ~tmp___1~1; [L5876] havoc ~tmp___2~3; [L5877] havoc ~tmp___3~1; [L5878] havoc ~tmp___4~2; [L5881] FCALL call #t~mem149 := read~$Pointer$({ base: ~skb!base, offset: 232 + ~skb!offset }, 8); [L5881] ~hdr~0 := #t~mem149; [L5881] havoc #t~mem149; [L5882] FCALL call #t~mem150 := read~$Pointer$({ base: ~skb!base, offset: 32 + ~skb!offset }, 8); [L5882] ~dev~0 := #t~mem150; [L5882] havoc #t~mem150; VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0] [L5883] CALL call #t~ret151 := get_ppp(~dev~0); VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5412-L5420] ~dev := #in~dev; [L5414] havoc ~tmp~9; VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5417] CALL call #t~ret59 := dev_to_hdlc(~dev); VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5400-L5408] ~dev := #in~dev; [L5402] havoc ~tmp~8; VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5405] CALL call #t~ret55 := netdev_priv(~dev); VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5348-L5355] ~dev := #in~dev; [L5353] #res := { base: ~dev!base, offset: 3264 + ~dev!offset }; VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #res!base=4113, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5405] RET call #t~ret55 := netdev_priv(~dev); VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~ret55!base=4113, #t~ret55!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5405] ~tmp~8 := #t~ret55; [L5405] havoc #t~ret55; [L5406] #res := ~tmp~8; VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #res!base=4113, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~8!base=4113, ~tmp~8!offset=0] [L5417] RET call #t~ret59 := dev_to_hdlc(~dev); VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~ret59!base=4113, #t~ret59!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5417] ~tmp~9 := #t~ret59; [L5417] havoc #t~ret59; [L5418] FCALL call #t~mem60 := read~$Pointer$({ base: ~tmp~9!base, offset: 100 + ~tmp~9!offset }, 8); [L5418] #res := #t~mem60; [L5418] havoc #t~mem60; VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #res!base=4174, #res!offset=-435, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~9!base=4113, ~tmp~9!offset=0] [L5883] RET call #t~ret151 := get_ppp(~dev~0); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~ret151!base=4174, #t~ret151!offset=-435, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0] [L5883] ~tmp~15 := #t~ret151; [L5883] havoc #t~ret151; [L5884] ~ppp~2 := ~tmp~15; VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5885] CALL call #t~ret152 := spinlock_check({ base: ~ppp~2!base, offset: 435 + ~ppp~2!offset }); VAL [#in~lock!base=4174, #in~lock!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5132-L5139] ~lock := #in~lock; [L5137] #res := { base: ~lock!base, offset: ~lock!offset }; VAL [#in~lock!base=4174, #in~lock!offset=0, #NULL!base=0, #NULL!offset=0, #res!base=4174, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~lock!base=4174, ~lock!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5885] RET call #t~ret152 := spinlock_check({ base: ~ppp~2!base, offset: 435 + ~ppp~2!offset }); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~ret152!base=4174, #t~ret152!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5885] ~tmp___0~5 := #t~ret152; [L5885] havoc #t~ret152; [L5886] FCALL call #t~ret153 := _raw_spin_lock_irqsave(~tmp___0~5); [L5886] ~flags~0 := #t~ret153; [L5886] havoc #t~ret153; [L5887] FCALL call #t~mem154 := read~int({ base: ~skb!base, offset: 104 + ~skb!offset }, 4); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem154=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5887] COND TRUE #t~mem154 % 4294967296 <= 3 [L5887] havoc #t~mem154; VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5994] FCALL call #t~mem193 := read~int({ base: ~dev~0!base, offset: 292 + ~dev~0!offset }, 8); [L5994] FCALL call write~int(1 + #t~mem193, { base: ~dev~0!base, offset: 292 + ~dev~0!offset }, 8); [L5994] havoc #t~mem193; VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5996] CALL call spin_unlock_irqrestore({ base: ~ppp~2!base, offset: 435 + ~ppp~2!offset }, ~flags~0); VAL [#in~flags=4124, #in~lock!base=4174, #in~lock!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5140-L5148] ~lock := #in~lock; [L5140-L5148] ~flags := #in~flags; [L5145] FCALL call _raw_spin_unlock_irqrestore({ base: ~lock!base, offset: ~lock!offset }, ~flags); VAL [#in~flags=4124, #in~lock!base=4174, #in~lock!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~flags=4124, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~lock!base=4174, ~lock!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5996] RET call spin_unlock_irqrestore({ base: ~ppp~2!base, offset: 435 + ~ppp~2!offset }, ~flags~0); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~flags~0=4124, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5997] CALL call dev_kfree_skb_any(~skb); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5358-L5366] ~skb := #in~skb; [L5363] FCALL call __dev_kfree_skb_any(~skb, 1); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0] [L5997] RET call dev_kfree_skb_any(~skb); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~flags~0=4124, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5998] CALL call ppp_tx_flush(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5519] havoc ~skb~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5526] CALL call #t~ret81 := ldv_skb_dequeue_12(~#tx_queue~0); VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6623-L6631] ~ldv_func_arg1 := #in~ldv_func_arg1; [L6625] havoc ~tmp~21; VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~ldv_func_arg1!base=4146, ~ldv_func_arg1!offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6628] CALL call #t~ret283 := ldv_skb_alloc(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6839] havoc ~skb~2; [L6840] havoc ~tmp___7~3; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6843] CALL call #t~ret293 := ldv_zalloc(248); VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0] [L5261] COND FALSE !(0 != ~tmp___0~1) [L5264] FCALL call #t~malloc39 := #Ultimate.alloc((if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296)); VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #t~malloc39!base=1, #t~malloc39!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0] [L5264] CALL call #Ultimate.meminit(#t~malloc39, 1, (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296), (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296)); VAL [#amountOfFields=1, #NULL!base=0, #NULL!offset=0, #product=248, #ptr!base=1, #ptr!offset=0, #sizeOfFields=248, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [?] #memory_int := ~initToZeroAtPointerBaseAddress~int(#memory_int, #ptr!base); VAL [#amountOfFields=1, #NULL!base=0, #NULL!offset=0, #product=248, #ptr!base=1, #ptr!offset=0, #sizeOfFields=248, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5264] RET call #Ultimate.meminit(#t~malloc39, 1, (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296), (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296)); VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #t~malloc39!base=1, #t~malloc39!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0] [L5264] ~tmp~2 := #t~malloc39; [L5265] ~p~1 := ~tmp~2; [L5266] assume 0 != (if 0 != (~p~1!base + ~p~1!offset) % 18446744073709551616 then 1 else 0); [L5267] #res := ~p~1; VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #res!base=1, #res!offset=0, #t~malloc39!base=1, #t~malloc39!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~p~1!base=1, ~p~1!offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0, ~tmp~2!base=1, ~tmp~2!offset=0] [L6843] RET call #t~ret293 := ldv_zalloc(248); VAL [#NULL!base=0, #NULL!offset=0, #t~ret293!base=1, #t~ret293!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6843] ~tmp___7~3 := #t~ret293; [L6843] havoc #t~ret293; [L6844] ~skb~2 := ~tmp___7~3; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~2!base=1, ~skb~2!offset=0, ~tmp___7~3!base=1, ~tmp___7~3!offset=0] [L6845] COND FALSE !(~skb~2 == { base: 0, offset: 0 }) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~2!base=1, ~skb~2!offset=0, ~tmp___7~3!base=1, ~tmp___7~3!offset=0] [L6848] CALL call ldv_set_add(~LDV_SKBS~0, ~skb~2); VAL [#in~e!base=1, #in~e!offset=0, #in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6692-L6719] ~set := #in~set; [L6692-L6719] ~e := #in~e; [L6694] havoc ~i~1; [L6697] ~i~1 := 0; VAL [#in~e!base=1, #in~e!offset=0, #in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~e!base=1, ~e!offset=0, ~i~1=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~set!base=0, ~set!offset=0] [L6698-L6710] COND FALSE !(false) VAL [#in~e!base=1, #in~e!offset=0, #in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~e!base=1, ~e!offset=0, ~i~1=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~set!base=0, ~set!offset=0] [L6699] COND FALSE !(~i~1 < ~last_index~0) VAL [#in~e!base=1, #in~e!offset=0, #in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~e!base=1, ~e!offset=0, ~i~1=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~set!base=0, ~set!offset=0] [L6711] COND TRUE ~last_index~0 < 15 [L6712] FCALL call write~$Pointer$(~e, { base: ~#set_impl~0!base, offset: ~#set_impl~0!offset + 8 * ~last_index~0 }, 8); [L6713] ~last_index~0 := 1 + ~last_index~0; VAL [#in~e!base=1, #in~e!offset=0, #in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~e!base=1, ~e!offset=0, ~i~1=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~set!base=0, ~set!offset=0] [L6848] RET call ldv_set_add(~LDV_SKBS~0, ~skb~2); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~2!base=1, ~skb~2!offset=0, ~tmp___7~3!base=1, ~tmp___7~3!offset=0] [L6849] #res := ~skb~2; VAL [#NULL!base=0, #NULL!offset=0, #res!base=1, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~2!base=1, ~skb~2!offset=0, ~tmp___7~3!base=1, ~tmp___7~3!offset=0] [L6628] RET call #t~ret283 := ldv_skb_alloc(); VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #t~ret283!base=1, #t~ret283!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~ldv_func_arg1!base=4146, ~ldv_func_arg1!offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6628] ~tmp~21 := #t~ret283; [L6628] havoc #t~ret283; [L6629] #res := ~tmp~21; VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #res!base=1, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~ldv_func_arg1!base=4146, ~ldv_func_arg1!offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~21!base=1, ~tmp~21!offset=0] [L5526] RET call #t~ret81 := ldv_skb_dequeue_12(~#tx_queue~0); VAL [#NULL!base=0, #NULL!offset=0, #t~ret81!base=1, #t~ret81!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5526] ~skb~0 := #t~ret81; [L5526] havoc #t~ret81; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~0!base=1, ~skb~0!offset=0] [L5527] COND TRUE 0 != (~skb~0!base + ~skb~0!offset) % 18446744073709551616 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~0!base=1, ~skb~0!offset=0] [L5524] FCALL call #t~ret80 := dev_queue_xmit(~skb~0); [L5524] assume -2147483648 <= #t~ret80 && #t~ret80 <= 2147483647; [L5524] havoc #t~ret80; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~0!base=1, ~skb~0!offset=0] [L5526] CALL call #t~ret81 := ldv_skb_dequeue_12(~#tx_queue~0); VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6623-L6631] ~ldv_func_arg1 := #in~ldv_func_arg1; [L6625] havoc ~tmp~21; VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~ldv_func_arg1!base=4146, ~ldv_func_arg1!offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6628] CALL call #t~ret283 := ldv_skb_alloc(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6839] havoc ~skb~2; [L6840] havoc ~tmp___7~3; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6843] CALL call #t~ret293 := ldv_zalloc(248); VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=1] [L5261] COND TRUE 0 != ~tmp___0~1 [L5262] #res := { base: 0, offset: 0 }; VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=1] [L6843] RET call #t~ret293 := ldv_zalloc(248); VAL [#NULL!base=0, #NULL!offset=0, #t~ret293!base=0, #t~ret293!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6843] ~tmp___7~3 := #t~ret293; [L6843] havoc #t~ret293; [L6844] ~skb~2 := ~tmp___7~3; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~2!base=0, ~skb~2!offset=0, ~tmp___7~3!base=0, ~tmp___7~3!offset=0] [L6845] COND TRUE ~skb~2 == { base: 0, offset: 0 } [L6846] #res := { base: 0, offset: 0 }; VAL [#NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~2!base=0, ~skb~2!offset=0, ~tmp___7~3!base=0, ~tmp___7~3!offset=0] [L6628] RET call #t~ret283 := ldv_skb_alloc(); VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #t~ret283!base=0, #t~ret283!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~ldv_func_arg1!base=4146, ~ldv_func_arg1!offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6628] ~tmp~21 := #t~ret283; [L6628] havoc #t~ret283; [L6629] #res := ~tmp~21; VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~ldv_func_arg1!base=4146, ~ldv_func_arg1!offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~21!base=0, ~tmp~21!offset=0] [L5526] RET call #t~ret81 := ldv_skb_dequeue_12(~#tx_queue~0); VAL [#NULL!base=0, #NULL!offset=0, #t~ret81!base=0, #t~ret81!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~0!base=1, ~skb~0!offset=0] [L5526] ~skb~0 := #t~ret81; [L5526] havoc #t~ret81; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~0!base=0, ~skb~0!offset=0] [L5527] COND FALSE !(0 != (~skb~0!base + ~skb~0!offset) % 18446744073709551616) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~0!base=0, ~skb~0!offset=0] [L5998] RET call ppp_tx_flush(); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~flags~0=4124, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5999] #res := 1; VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #res=1, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~flags~0=4124, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L6461] RET call #t~ret270 := ppp_rx(~proto_group0~0); VAL [#NULL!base=0, #NULL!offset=0, #t~ret270=1, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6461] assume -2147483648 <= #t~ret270 && #t~ret270 <= 2147483647; [L6461] havoc #t~ret270; [L6462] ~ldv_state_variable_3~0 := 1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6466] COND FALSE !(3 == ~ldv_state_variable_3~0) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6472] COND FALSE !(2 == ~ldv_state_variable_3~0) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6478] COND FALSE !(5 == ~ldv_state_variable_3~0) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6318] assume -2147483648 <= #t~nondet252 && #t~nondet252 <= 2147483647; [L6318] ~tmp___6~1 := #t~nondet252; [L6318] havoc #t~nondet252; [L6320] #t~switch253 := 0 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=false, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND FALSE !(#t~switch253) [L6327] #t~switch253 := #t~switch253 || 1 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND TRUE #t~switch253 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6328] COND TRUE 0 != ~ldv_state_variable_0~0 [L6329] assume -2147483648 <= #t~nondet254 && #t~nondet254 <= 2147483647; [L6329] ~tmp___7~1 := #t~nondet254; [L6329] havoc #t~nondet254; [L6331] #t~switch255 := 0 == ~tmp___7~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6330-L6363] COND TRUE #t~switch255 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6332] COND TRUE 3 == ~ldv_state_variable_0~0 && 0 == ~ref_cnt~0 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6333] CALL call mod_exit(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6193] FCALL call unregister_hdlc_protocol(~#proto~0); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6333] RET call mod_exit(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6334] ~ldv_state_variable_0~0 := 2; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6574] CALL call ldv_check_final_state(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6916] havoc ~tmp___7~7; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6919] CALL call #t~ret297 := ldv_set_is_empty(~LDV_SKBS~0); VAL [#in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6785-L6792] ~set := #in~set; [L6790] #res := (if 0 == ~last_index~0 then 1 else 0); VAL [#in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #res=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~set!base=0, ~set!offset=0] [L6919] RET call #t~ret297 := ldv_set_is_empty(~LDV_SKBS~0); VAL [#NULL!base=0, #NULL!offset=0, #t~ret297=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6919] assume -2147483648 <= #t~ret297 && #t~ret297 <= 2147483647; [L6919] ~tmp___7~7 := #t~ret297; [L6919] havoc #t~ret297; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___7~7=0] [L6920-L6924] COND FALSE !(0 != ~tmp___7~7) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___7~7=0] [L6923] CALL call ldv_error(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5304] assert false; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] ----- [2018-11-23 05:15:38,611 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 4152 could not be translated for associated CType STRUCT~~hdlc_proto?open~*((*net_device ) : INT)?close~*((*net_device ) : VOID)?start~*((*net_device ) : VOID)?stop~*((*net_device ) : VOID)?detach~*((*net_device ) : VOID)?ioctl~*((*net_device *ifreq ) : INT)?type_trans~*((*sk_buff *net_device ) : ~__be16~0)?netif_rx~*((*sk_buff ) : INT)?xmit~*((*sk_buff *net_device ) : ~netdev_tx_t~0)?module~*module?next~*hdlc_proto# [2018-11-23 05:15:38,611 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 4140 could not be translated for associated CType ARRAY#_13_~ARRAY#_7_~INT## [2018-11-23 05:15:38,612 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 4123 could not be translated for associated CType ARRAY#_15_~~Element~0# [2018-11-23 05:15:38,638 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 4131 could not be translated for associated CType STRUCT~~header_ops?create~*((*sk_buff *net_device USHORT *VOID *VOID UINT ) : INT)?parse~*((*sk_buff *UCHAR ) : INT)?rebuild~*((*sk_buff ) : INT)?cache~*((*neighbour *hh_cache ~__be16~0 ) : INT)?cache_update~*((*hh_cache *net_device *UCHAR ) : VOID)# [2018-11-23 05:15:38,638 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 4117 could not be translated for associated CType STRUCT~~sk_buff_head?next~*sk_buff?prev~*sk_buff?qlen~~__u32~0?lock~~spinlock_t~0# [2018-11-23 05:15:38,639 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 4168 could not be translated for associated CType ARRAY#_15_~~Element~0# [2018-11-23 05:15:38,639 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 4118 could not be translated for associated CType ARRAY#_13_~ARRAY#_7_~INT## [2018-11-23 05:15:38,639 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 4159 could not be translated for associated CType STRUCT~~sk_buff_head?next~*sk_buff?prev~*sk_buff?qlen~~__u32~0?lock~~spinlock_t~0# [2018-11-23 05:15:38,639 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 4126 could not be translated for associated CType STRUCT~~header_ops?create~*((*sk_buff *net_device USHORT *VOID *VOID UINT ) : INT)?parse~*((*sk_buff *UCHAR ) : INT)?rebuild~*((*sk_buff ) : INT)?cache~*((*neighbour *hh_cache ~__be16~0 ) : INT)?cache_update~*((*hh_cache *net_device *UCHAR ) : VOID)# [2018-11-23 05:15:38,639 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: IntegerLiteral 4137 could not be translated for associated CType STRUCT~~hdlc_proto?open~*((*net_device ) : INT)?close~*((*net_device ) : VOID)?start~*((*net_device ) : VOID)?stop~*((*net_device ) : VOID)?detach~*((*net_device ) : VOID)?ioctl~*((*net_device *ifreq ) : INT)?type_trans~*((*sk_buff *net_device ) : ~__be16~0)?netif_rx~*((*sk_buff ) : INT)?xmit~*((*sk_buff *net_device ) : ~netdev_tx_t~0)?module~*module?next~*hdlc_proto# [2018-11-23 05:15:38,648 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,649 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,649 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,650 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,650 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,653 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,654 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,654 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,683 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,686 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,687 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,687 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,687 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,688 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,688 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,688 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,688 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,688 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,689 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,689 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,689 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,690 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,690 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,690 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,710 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,714 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,714 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,715 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,715 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,715 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,715 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,715 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,716 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,716 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,716 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,716 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,717 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,717 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,717 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,717 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,717 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,718 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,750 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,751 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,751 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,751 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,751 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,751 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,752 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,752 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,752 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,753 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,753 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement [2018-11-23 05:15:38,753 WARN L1272 BoogieBacktranslator]: Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement ----- class de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator.CACSL2BoogieBacktranslator [?] CALL call ULTIMATE.init(); VAL [#NULL!base=4128, #NULL!offset=4164, #t~string114!base=4136, #t~string114!offset=4161, #t~string121!base=4106, #t~string121!offset=4144, #t~string211!base=4166, #t~string211!offset=4109, #t~string22!base=4176, #t~string22!offset=4143, #t~string237!base=4115, #t~string237!offset=4138, #t~string64!base=4172, #t~string64!offset=4155, #t~string65!base=4153, #t~string65!offset=4180, #t~string66!base=4150, #t~string66!offset=4103, #t~string84!base=4158, #t~string84!offset=4112, old(#NULL!base)=4128, old(#NULL!offset)=4164, old(#t~string114!base)=4136, old(#t~string114!offset)=4161, old(#t~string121!base)=4106, old(#t~string121!offset)=4144, old(#t~string211!base)=4166, old(#t~string211!offset)=4109, old(#t~string22!base)=4176, old(#t~string22!offset)=4143, old(#t~string237!base)=4115, old(#t~string237!offset)=4138, old(#t~string64!base)=4172, old(#t~string64!offset)=4155, old(#t~string65!base)=4153, old(#t~string65!offset)=4180, old(#t~string66!base)=4150, old(#t~string66!offset)=4103, old(#t~string84!base)=4158, old(#t~string84!offset)=4112, old(~#cp_table~0!base)=4118, old(~#cp_table~0!offset)=4140, old(~#ppp_header_ops~0!base)=4131, old(~#ppp_header_ops~0!offset)=4126, old(~#proto~0!base)=4137, old(~#proto~0!offset)=4152, old(~#set_impl~0!base)=4168, old(~#set_impl~0!offset)=4123, old(~#tx_queue~0!base)=4159, old(~#tx_queue~0!offset)=4117, old(~last_index~0)=4160, old(~LDV_IN_INTERRUPT~0)=4120, old(~ldv_retval_0~0)=4116, old(~LDV_SKBS~0!base)=4104, old(~LDV_SKBS~0!offset)=4125, old(~ldv_state_variable_0~0)=4129, old(~ldv_state_variable_1~0)=4162, old(~ldv_state_variable_2~0)=4149, old(~ldv_state_variable_3~0)=4179, old(~ldv_timer_list_1~0!base)=4169, old(~ldv_timer_list_1~0!offset)=4170, old(~ldv_timer_state_1~0)=4177, old(~proto_group0~0!base)=4141, old(~proto_group0~0!offset)=4145, old(~proto_group1~0!base)=4122, old(~proto_group1~0!offset)=4134, old(~ref_cnt~0)=4147, ~#cp_table~0!base=4118, ~#cp_table~0!offset=4140, ~#ppp_header_ops~0!base=4131, ~#ppp_header_ops~0!offset=4126, ~#proto~0!base=4137, ~#proto~0!offset=4152, ~#set_impl~0!base=4168, ~#set_impl~0!offset=4123, ~#tx_queue~0!base=4159, ~#tx_queue~0!offset=4117, ~last_index~0=4160, ~LDV_IN_INTERRUPT~0=4120, ~ldv_retval_0~0=4116, ~LDV_SKBS~0!base=4104, ~LDV_SKBS~0!offset=4125, ~ldv_state_variable_0~0=4129, ~ldv_state_variable_1~0=4162, ~ldv_state_variable_2~0=4149, ~ldv_state_variable_3~0=4179, ~ldv_timer_list_1~0!base=4169, ~ldv_timer_list_1~0!offset=4170, ~ldv_timer_state_1~0=4177, ~proto_group0~0!base=4141, ~proto_group0~0!offset=4145, ~proto_group1~0!base=4122, ~proto_group1~0!offset=4134, ~ref_cnt~0=4147] [?] #NULL := { base: 0, offset: 0 }; [?] #valid[0] := 0; [L5195] FCALL call #t~string22 := #Ultimate.alloc(22); [L5448] FCALL call #t~string64 := #Ultimate.alloc(4); [L5448] FCALL call write~init~int(76, { base: #t~string64!base, offset: #t~string64!offset }, 1); [L5448] FCALL call write~init~int(67, { base: #t~string64!base, offset: 1 + #t~string64!offset }, 1); [L5448] FCALL call write~init~int(80, { base: #t~string64!base, offset: 2 + #t~string64!offset }, 1); [L5448] FCALL call write~init~int(0, { base: #t~string64!base, offset: 3 + #t~string64!offset }, 1); [L5450] FCALL call #t~string65 := #Ultimate.alloc(5); [L5450] FCALL call write~init~int(73, { base: #t~string65!base, offset: #t~string65!offset }, 1); [L5450] FCALL call write~init~int(80, { base: #t~string65!base, offset: 1 + #t~string65!offset }, 1); [L5450] FCALL call write~init~int(67, { base: #t~string65!base, offset: 2 + #t~string65!offset }, 1); [L5450] FCALL call write~init~int(80, { base: #t~string65!base, offset: 3 + #t~string65!offset }, 1); [L5450] FCALL call write~init~int(0, { base: #t~string65!base, offset: 4 + #t~string65!offset }, 1); [L5452] FCALL call #t~string66 := #Ultimate.alloc(7); [L5452] FCALL call write~init~int(73, { base: #t~string66!base, offset: #t~string66!offset }, 1); [L5452] FCALL call write~init~int(80, { base: #t~string66!base, offset: 1 + #t~string66!offset }, 1); [L5452] FCALL call write~init~int(86, { base: #t~string66!base, offset: 2 + #t~string66!offset }, 1); [L5452] FCALL call write~init~int(54, { base: #t~string66!base, offset: 3 + #t~string66!offset }, 1); [L5452] FCALL call write~init~int(67, { base: #t~string66!base, offset: 4 + #t~string66!offset }, 1); [L5452] FCALL call write~init~int(80, { base: #t~string66!base, offset: 5 + #t~string66!offset }, 1); [L5452] FCALL call write~init~int(0, { base: #t~string66!base, offset: 6 + #t~string66!offset }, 1); [L5561] FCALL call #t~string84 := #Ultimate.alloc(30); [L5719] FCALL call #t~string114 := #Ultimate.alloc(7); [L5719] FCALL call write~init~int(37, { base: #t~string114!base, offset: #t~string114!offset }, 1); [L5719] FCALL call write~init~int(115, { base: #t~string114!base, offset: 1 + #t~string114!offset }, 1); [L5719] FCALL call write~init~int(32, { base: #t~string114!base, offset: 2 + #t~string114!offset }, 1); [L5719] FCALL call write~init~int(117, { base: #t~string114!base, offset: 3 + #t~string114!offset }, 1); [L5719] FCALL call write~init~int(112, { base: #t~string114!base, offset: 4 + #t~string114!offset }, 1); [L5719] FCALL call write~init~int(10, { base: #t~string114!base, offset: 5 + #t~string114!offset }, 1); [L5719] FCALL call write~init~int(0, { base: #t~string114!base, offset: 6 + #t~string114!offset }, 1); [L5736] FCALL call #t~string121 := #Ultimate.alloc(9); [L6035] FCALL call #t~string211 := #Ultimate.alloc(11); [L6163] FCALL call #t~string237 := #Ultimate.alloc(21); [L5333] ~LDV_IN_INTERRUPT~0 := 1; [L5335] ~ldv_state_variable_0~0 := 0; [L5336] ~ldv_state_variable_3~0 := 0; [L5337] ~ldv_timer_state_1~0 := 0; [L5338] ~ldv_state_variable_2~0 := 0; [L5340] ~ref_cnt~0 := 0; [L5341] ~ldv_state_variable_1~0 := 0; [L5595-L5621] FCALL call ~#cp_table~0 := #Ultimate.alloc(364); [L5595-L5621] FCALL call write~init~int(163, { base: ~#cp_table~0!base, offset: ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 4 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 8 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 12 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 16 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 20 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 24 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 28 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(0, { base: ~#cp_table~0!base, offset: 32 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(0, { base: ~#cp_table~0!base, offset: 36 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(0, { base: ~#cp_table~0!base, offset: 40 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(0, { base: ~#cp_table~0!base, offset: 44 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(0, { base: ~#cp_table~0!base, offset: 48 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(0, { base: ~#cp_table~0!base, offset: 52 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 56 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 60 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1026, { base: ~#cp_table~0!base, offset: 64 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(131, { base: ~#cp_table~0!base, offset: 68 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(131, { base: ~#cp_table~0!base, offset: 72 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(133, { base: ~#cp_table~0!base, offset: 76 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 80 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 84 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 88 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1, { base: ~#cp_table~0!base, offset: 92 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1, { base: ~#cp_table~0!base, offset: 96 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1, { base: ~#cp_table~0!base, offset: 100 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1, { base: ~#cp_table~0!base, offset: 104 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(16, { base: ~#cp_table~0!base, offset: 108 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2048, { base: ~#cp_table~0!base, offset: 112 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(421, { base: ~#cp_table~0!base, offset: 116 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2, { base: ~#cp_table~0!base, offset: 120 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(261, { base: ~#cp_table~0!base, offset: 124 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(262, { base: ~#cp_table~0!base, offset: 128 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(261, { base: ~#cp_table~0!base, offset: 132 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(389, { base: ~#cp_table~0!base, offset: 136 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2048, { base: ~#cp_table~0!base, offset: 140 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(675, { base: ~#cp_table~0!base, offset: 144 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2, { base: ~#cp_table~0!base, offset: 148 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(515, { base: ~#cp_table~0!base, offset: 152 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(516, { base: ~#cp_table~0!base, offset: 156 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(515, { base: ~#cp_table~0!base, offset: 160 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(643, { base: ~#cp_table~0!base, offset: 164 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2048, { base: ~#cp_table~0!base, offset: 168 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2049, { base: ~#cp_table~0!base, offset: 172 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2, { base: ~#cp_table~0!base, offset: 176 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(36, { base: ~#cp_table~0!base, offset: 180 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(131, { base: ~#cp_table~0!base, offset: 184 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(6, { base: ~#cp_table~0!base, offset: 188 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(131, { base: ~#cp_table~0!base, offset: 192 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2048, { base: ~#cp_table~0!base, offset: 196 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2049, { base: ~#cp_table~0!base, offset: 200 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2, { base: ~#cp_table~0!base, offset: 204 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(163, { base: ~#cp_table~0!base, offset: 208 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(131, { base: ~#cp_table~0!base, offset: 212 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(165, { base: ~#cp_table~0!base, offset: 216 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(131, { base: ~#cp_table~0!base, offset: 220 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2048, { base: ~#cp_table~0!base, offset: 224 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2049, { base: ~#cp_table~0!base, offset: 228 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2050, { base: ~#cp_table~0!base, offset: 232 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2051, { base: ~#cp_table~0!base, offset: 236 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2051, { base: ~#cp_table~0!base, offset: 240 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2051, { base: ~#cp_table~0!base, offset: 244 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2114, { base: ~#cp_table~0!base, offset: 248 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(0, { base: ~#cp_table~0!base, offset: 252 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1, { base: ~#cp_table~0!base, offset: 256 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1, { base: ~#cp_table~0!base, offset: 260 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(3, { base: ~#cp_table~0!base, offset: 264 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(3, { base: ~#cp_table~0!base, offset: 268 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(5, { base: ~#cp_table~0!base, offset: 272 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(131, { base: ~#cp_table~0!base, offset: 276 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(4096, { base: ~#cp_table~0!base, offset: 280 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(4097, { base: ~#cp_table~0!base, offset: 284 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(4098, { base: ~#cp_table~0!base, offset: 288 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(4099, { base: ~#cp_table~0!base, offset: 292 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(4100, { base: ~#cp_table~0!base, offset: 296 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(4101, { base: ~#cp_table~0!base, offset: 300 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(4102, { base: ~#cp_table~0!base, offset: 304 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(0, { base: ~#cp_table~0!base, offset: 308 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1, { base: ~#cp_table~0!base, offset: 312 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(2, { base: ~#cp_table~0!base, offset: 316 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(3, { base: ~#cp_table~0!base, offset: 320 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(3, { base: ~#cp_table~0!base, offset: 324 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(5, { base: ~#cp_table~0!base, offset: 328 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(6, { base: ~#cp_table~0!base, offset: 332 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(0, { base: ~#cp_table~0!base, offset: 336 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1, { base: ~#cp_table~0!base, offset: 340 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1, { base: ~#cp_table~0!base, offset: 344 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1, { base: ~#cp_table~0!base, offset: 348 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1, { base: ~#cp_table~0!base, offset: 352 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1, { base: ~#cp_table~0!base, offset: 356 + ~#cp_table~0!offset }, 4); [L5595-L5621] FCALL call write~init~int(1058, { base: ~#cp_table~0!base, offset: 360 + ~#cp_table~0!offset }, 4); [L6197] ~ldv_retval_0~0 := 0; [L6679] ~last_index~0 := 0; [L5334] ~proto_group1~0 := { base: 0, offset: 0 }; [L5339] ~proto_group0~0 := { base: 0, offset: 0 }; [L5342] ~ldv_timer_list_1~0 := { base: 0, offset: 0 }; [L5410] FCALL call ~#tx_queue~0 := #Ultimate.alloc(88); [L5410] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#tx_queue~0!base, offset: ~#tx_queue~0!offset }, 8); [L5410] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#tx_queue~0!base, offset: 8 + ~#tx_queue~0!offset }, 8); [L5410] FCALL call write~init~int(0, { base: ~#tx_queue~0!base, offset: 16 + ~#tx_queue~0!offset }, 4); [L5410] FCALL call write~init~int(0, { base: ~#tx_queue~0!base, offset: 20 + ~#tx_queue~0!offset }, 4); [L5410] FCALL call write~init~int(0, { base: ~#tx_queue~0!base, offset: 24 + ~#tx_queue~0!offset }, 4); [L5410] FCALL call write~init~int(0, { base: ~#tx_queue~0!base, offset: 28 + ~#tx_queue~0!offset }, 4); [L5410] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#tx_queue~0!base, offset: 32 + ~#tx_queue~0!offset }, 8); [L5410] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#tx_queue~0!base, offset: 40 + ~#tx_queue~0!offset }, 8); [L5410] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#tx_queue~0!base, offset: 48 + ~#tx_queue~0!offset }, 8); [L5410] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#tx_queue~0!base, offset: 56 + ~#tx_queue~0!offset }, 8); [L5410] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#tx_queue~0!base, offset: 64 + ~#tx_queue~0!offset }, 8); [L5410] FCALL call write~init~int(0, { base: ~#tx_queue~0!base, offset: 72 + ~#tx_queue~0!offset }, 4); [L5410] FCALL call write~init~int(0, { base: ~#tx_queue~0!base, offset: 76 + ~#tx_queue~0!offset }, 8); [L6104-L6106] FCALL call ~#proto~0 := #Ultimate.alloc(88); [L6104-L6106] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#proto~0!base, offset: ~#proto~0!offset }, 8); [L6104-L6106] FCALL call write~init~$Pointer$(#funAddr~ppp_close, { base: ~#proto~0!base, offset: 8 + ~#proto~0!offset }, 8); [L6104-L6106] FCALL call write~init~$Pointer$(#funAddr~ppp_start, { base: ~#proto~0!base, offset: 16 + ~#proto~0!offset }, 8); [L6104-L6106] FCALL call write~init~$Pointer$(#funAddr~ppp_stop, { base: ~#proto~0!base, offset: 24 + ~#proto~0!offset }, 8); [L6104-L6106] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#proto~0!base, offset: 32 + ~#proto~0!offset }, 8); [L6104-L6106] FCALL call write~init~$Pointer$(#funAddr~ppp_ioctl, { base: ~#proto~0!base, offset: 40 + ~#proto~0!offset }, 8); [L6104-L6106] FCALL call write~init~$Pointer$(#funAddr~ppp_type_trans, { base: ~#proto~0!base, offset: 48 + ~#proto~0!offset }, 8); [L6104-L6106] FCALL call write~init~$Pointer$(#funAddr~ppp_rx, { base: ~#proto~0!base, offset: 56 + ~#proto~0!offset }, 8); [L6104-L6106] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#proto~0!base, offset: 64 + ~#proto~0!offset }, 8); [L6104-L6106] FCALL call write~init~$Pointer$(~#__this_module~0, { base: ~#proto~0!base, offset: 72 + ~#proto~0!offset }, 8); [L6104-L6106] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#proto~0!base, offset: 80 + ~#proto~0!offset }, 8); [L6107] FCALL call ~#ppp_header_ops~0 := #Ultimate.alloc(40); [L6107] FCALL call write~init~$Pointer$(#funAddr~ppp_hard_header, { base: ~#ppp_header_ops~0!base, offset: ~#ppp_header_ops~0!offset }, 8); [L6107] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#ppp_header_ops~0!base, offset: 8 + ~#ppp_header_ops~0!offset }, 8); [L6107] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#ppp_header_ops~0!base, offset: 16 + ~#ppp_header_ops~0!offset }, 8); [L6107] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#ppp_header_ops~0!base, offset: 24 + ~#ppp_header_ops~0!offset }, 8); [L6107] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#ppp_header_ops~0!base, offset: 32 + ~#ppp_header_ops~0!offset }, 8); [L6678] FCALL call ~#set_impl~0 := #Ultimate.alloc(120); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 8 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 16 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 24 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 32 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 40 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 48 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 56 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 64 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 72 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 80 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 88 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 96 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 104 + ~#set_impl~0!offset }, 8); [L6678] FCALL call write~init~$Pointer$({ base: 0, offset: 0 }, { base: ~#set_impl~0!base, offset: 112 + ~#set_impl~0!offset }, 8); [L6836] ~LDV_SKBS~0 := { base: 0, offset: 0 }; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(#NULL!base)=4128, old(#NULL!offset)=4164, old(#t~string114!base)=4136, old(#t~string114!offset)=4161, old(#t~string121!base)=4106, old(#t~string121!offset)=4144, old(#t~string211!base)=4166, old(#t~string211!offset)=4109, old(#t~string22!base)=4176, old(#t~string22!offset)=4143, old(#t~string237!base)=4115, old(#t~string237!offset)=4138, old(#t~string64!base)=4172, old(#t~string64!offset)=4155, old(#t~string65!base)=4153, old(#t~string65!offset)=4180, old(#t~string66!base)=4150, old(#t~string66!offset)=4103, old(#t~string84!base)=4158, old(#t~string84!offset)=4112, old(~#cp_table~0!base)=4118, old(~#cp_table~0!offset)=4140, old(~#ppp_header_ops~0!base)=4131, old(~#ppp_header_ops~0!offset)=4126, old(~#proto~0!base)=4137, old(~#proto~0!offset)=4152, old(~#set_impl~0!base)=4168, old(~#set_impl~0!offset)=4123, old(~#tx_queue~0!base)=4159, old(~#tx_queue~0!offset)=4117, old(~last_index~0)=4160, old(~LDV_IN_INTERRUPT~0)=4120, old(~ldv_retval_0~0)=4116, old(~LDV_SKBS~0!base)=4104, old(~LDV_SKBS~0!offset)=4125, old(~ldv_state_variable_0~0)=4129, old(~ldv_state_variable_1~0)=4162, old(~ldv_state_variable_2~0)=4149, old(~ldv_state_variable_3~0)=4179, old(~ldv_timer_list_1~0!base)=4169, old(~ldv_timer_list_1~0!offset)=4170, old(~ldv_timer_state_1~0)=4177, old(~proto_group0~0!base)=4141, old(~proto_group0~0!offset)=4145, old(~proto_group1~0!base)=4122, old(~proto_group1~0!offset)=4134, old(~ref_cnt~0)=4147, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [?] RET call ULTIMATE.init(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [?] CALL call #t~ret298 := main(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6277] havoc ~ldvarg0~0; [L6278] havoc ~tmp~20; [L6279] havoc ~ldvarg1~0; [L6280] havoc ~tmp___0~9; [L6281] havoc ~ldvarg4~0; [L6282] havoc ~tmp___1~3; [L6283] havoc ~ldvarg3~0; [L6284] havoc ~tmp___2~5; [L6285] havoc ~ldvarg5~0; [L6286] havoc ~tmp___3~2; [L6287] havoc ~ldvarg2~0; [L6288] havoc ~tmp___4~3; [L6289] havoc ~ldvarg6~0; [L6290] havoc ~tmp___5~1; [L6291] havoc ~tmp___6~1; [L6292] havoc ~tmp___7~1; [L6293] havoc ~tmp___8~0; [L6294] havoc ~tmp___9~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6297] CALL call #t~ret245 := ldv_zalloc(40); VAL [#in~size=40, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=40, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=40, ~tmp___0~1=1] [L5261] COND TRUE 0 != ~tmp___0~1 [L5262] #res := { base: 0, offset: 0 }; VAL [#in~size=40, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=40, ~tmp___0~1=1] [L6297] RET call #t~ret245 := ldv_zalloc(40); VAL [#NULL!base=0, #NULL!offset=0, #t~ret245!base=0, #t~ret245!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6297] ~tmp~20 := #t~ret245; [L6297] havoc #t~ret245; [L6298] ~ldvarg0~0 := ~tmp~20; [L6299] ~tmp___0~9 := #t~nondet246; [L6299] havoc #t~nondet246; [L6300] ~ldvarg1~0 := ~tmp___0~9; [L6301] ~tmp___1~3 := #t~nondet247; [L6301] havoc #t~nondet247; [L6302] ~ldvarg4~0 := ~tmp___1~3; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg4~0=4173, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp~20!base=0, ~tmp~20!offset=0] [L6303] CALL call #t~ret248 := ldv_zalloc(232); VAL [#in~size=232, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=232, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=232, ~tmp___0~1=1] [L5261] COND TRUE 0 != ~tmp___0~1 [L5262] #res := { base: 0, offset: 0 }; VAL [#in~size=232, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=232, ~tmp___0~1=1] [L6303] RET call #t~ret248 := ldv_zalloc(232); VAL [#NULL!base=0, #NULL!offset=0, #t~ret248!base=0, #t~ret248!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg4~0=4173, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp~20!base=0, ~tmp~20!offset=0] [L6303] ~tmp___2~5 := #t~ret248; [L6303] havoc #t~ret248; [L6304] ~ldvarg3~0 := ~tmp___2~5; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6305] CALL call #t~ret249 := ldv_zalloc(3264); VAL [#in~size=3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=3264, ~tmp___0~1=1] [L5261] COND TRUE 0 != ~tmp___0~1 [L5262] #res := { base: 0, offset: 0 }; VAL [#in~size=3264, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=3264, ~tmp___0~1=1] [L6305] RET call #t~ret249 := ldv_zalloc(3264); VAL [#NULL!base=0, #NULL!offset=0, #t~ret249!base=0, #t~ret249!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6305] ~tmp___3~2 := #t~ret249; [L6305] havoc #t~ret249; [L6306] ~ldvarg5~0 := ~tmp___3~2; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6307] CALL call #t~ret250 := ldv_zalloc(1); VAL [#in~size=1, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=1, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=1, ~tmp___0~1=1] [L5261] COND TRUE 0 != ~tmp___0~1 [L5262] #res := { base: 0, offset: 0 }; VAL [#in~size=1, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=1, ~tmp___0~1=1] [L6307] RET call #t~ret250 := ldv_zalloc(1); VAL [#NULL!base=0, #NULL!offset=0, #t~ret250!base=0, #t~ret250!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6307] ~tmp___4~3 := #t~ret250; [L6307] havoc #t~ret250; [L6308] ~ldvarg2~0 := ~tmp___4~3; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6309] CALL call #t~ret251 := ldv_zalloc(1); VAL [#in~size=1, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=1, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=1, ~tmp___0~1=1] [L5261] COND TRUE 0 != ~tmp___0~1 [L5262] #res := { base: 0, offset: 0 }; VAL [#in~size=1, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=1, ~tmp___0~1=1] [L6309] RET call #t~ret251 := ldv_zalloc(1); VAL [#NULL!base=0, #NULL!offset=0, #t~ret251!base=0, #t~ret251!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6309] ~tmp___5~1 := #t~ret251; [L6309] havoc #t~ret251; [L6310] ~ldvarg6~0 := ~tmp___5~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6311] CALL call ldv_initialize(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6858] CALL call ldv_set_init(~LDV_SKBS~0); VAL [#in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6681-L6690] ~set := #in~set; [L6686] ~set := ~#set_impl~0; [L6687] ~last_index~0 := 0; VAL [#in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~set!base=4156, ~set!offset=0] [L6858] RET call ldv_set_init(~LDV_SKBS~0); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6311] RET call ldv_initialize(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=0, ~ldv_state_variable_1~0=0, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6312] ~ldv_state_variable_1~0 := 1; [L6313] ~ref_cnt~0 := 0; [L6314] ~ldv_state_variable_0~0 := 1; [L6315] ~ldv_state_variable_3~0 := 0; [L6316] ~ldv_state_variable_2~0 := 0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp~20!base=0, ~tmp~20!offset=0] [L6318] assume -2147483648 <= #t~nondet252 && #t~nondet252 <= 2147483647; [L6318] ~tmp___6~1 := #t~nondet252; [L6318] havoc #t~nondet252; [L6320] #t~switch253 := 0 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND FALSE !(#t~switch253) [L6327] #t~switch253 := #t~switch253 || 1 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND TRUE #t~switch253 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6328] COND TRUE 0 != ~ldv_state_variable_0~0 [L6329] assume -2147483648 <= #t~nondet254 && #t~nondet254 <= 2147483647; [L6329] ~tmp___7~1 := #t~nondet254; [L6329] havoc #t~nondet254; [L6331] #t~switch255 := 0 == ~tmp___7~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6330-L6363] COND FALSE !(#t~switch255) [L6340] #t~switch255 := #t~switch255 || 1 == ~tmp___7~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6330-L6363] COND TRUE #t~switch255 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6341] COND TRUE 1 == ~ldv_state_variable_0~0 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6342] CALL call #t~ret256 := mod_init(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6183] CALL call skb_queue_head_init(~#tx_queue~0); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5189-L5199] ~list := #in~list; [L5191] FCALL call ~#__key~0 := #Ultimate.alloc(8); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__key~0!base=4167, ~#__key~0!offset=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~list!base=4146, ~list!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5194] CALL call #t~ret21 := spinlock_check({ base: ~list!base, offset: 20 + ~list!offset }); VAL [#in~lock!base=4146, #in~lock!offset=20, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5132-L5139] ~lock := #in~lock; [L5137] #res := { base: ~lock!base, offset: ~lock!offset }; VAL [#in~lock!base=4146, #in~lock!offset=20, #NULL!base=0, #NULL!offset=0, #res!base=4146, #res!offset=20, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~lock!base=4146, ~lock!offset=20, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5194] RET call #t~ret21 := spinlock_check({ base: ~list!base, offset: 20 + ~list!offset }); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~ret21!base=4146, #t~ret21!offset=20, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__key~0!base=4167, ~#__key~0!offset=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~list!base=4146, ~list!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5194] havoc #t~ret21; [L5195] FCALL call __raw_spin_lock_init({ base: ~list!base, offset: 20 + ~list!offset }, #t~string22, ~#__key~0); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__key~0!base=4167, ~#__key~0!offset=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~list!base=4146, ~list!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5196] CALL call __skb_queue_head_init(~list); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5177-L5188] ~list := #in~list; [L5179] havoc ~tmp~0; [L5182] ~tmp~0 := ~list; [L5183] FCALL call write~$Pointer$(~tmp~0, { base: ~list!base, offset: ~list!offset }, 8); [L5184] FCALL call write~$Pointer$(~tmp~0, { base: ~list!base, offset: 8 + ~list!offset }, 8); [L5185] FCALL call write~int(0, { base: ~list!base, offset: 16 + ~list!offset }, 4); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~list!base=4146, ~list!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~0!base=4146, ~tmp~0!offset=0] [L5196] RET call __skb_queue_head_init(~list); VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__key~0!base=4167, ~#__key~0!offset=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~list!base=4146, ~list!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5191] FCALL call ULTIMATE.dealloc(~#__key~0); [L5197] havoc ~#__key~0; VAL [#in~list!base=4146, #in~list!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~list!base=4146, ~list!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6183] RET call skb_queue_head_init(~#tx_queue~0); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6184] FCALL call register_hdlc_protocol(~#proto~0); [L6185] #res := 0; VAL [#NULL!base=0, #NULL!offset=0, #res=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6342] RET call #t~ret256 := mod_init(); VAL [#NULL!base=0, #NULL!offset=0, #t~ret256=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6342] assume -2147483648 <= #t~ret256 && #t~ret256 <= 2147483647; [L6342] ~ldv_retval_0~0 := #t~ret256; [L6342] havoc #t~ret256; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=1, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=0, ~ldv_state_variable_3~0=0, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6343] COND TRUE 0 == ~ldv_retval_0~0 [L6344] ~ldv_state_variable_0~0 := 3; [L6345] ~ldv_state_variable_2~0 := 1; [L6346] ~ldv_state_variable_3~0 := 1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6347] CALL call ldv_initialize_hdlc_proto_3(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6228] havoc ~tmp~19; [L6229] havoc ~tmp___0~8; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6232] CALL call #t~ret239 := ldv_zalloc(3264); VAL [#in~size=3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=3264, ~tmp___0~1=1] [L5261] COND TRUE 0 != ~tmp___0~1 [L5262] #res := { base: 0, offset: 0 }; VAL [#in~size=3264, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=3264, ~tmp___0~1=1] [L6232] RET call #t~ret239 := ldv_zalloc(3264); VAL [#NULL!base=0, #NULL!offset=0, #t~ret239!base=0, #t~ret239!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6232] ~tmp~19 := #t~ret239; [L6232] havoc #t~ret239; [L6233] ~proto_group1~0 := ~tmp~19; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~19!base=0, ~tmp~19!offset=0] [L6234] CALL call #t~ret240 := ldv_zalloc(232); VAL [#in~size=232, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=232, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=232, ~tmp___0~1=1] [L5261] COND TRUE 0 != ~tmp___0~1 [L5262] #res := { base: 0, offset: 0 }; VAL [#in~size=232, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=232, ~tmp___0~1=1] [L6234] RET call #t~ret240 := ldv_zalloc(232); VAL [#NULL!base=0, #NULL!offset=0, #t~ret240!base=0, #t~ret240!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~19!base=0, ~tmp~19!offset=0] [L6234] ~tmp___0~8 := #t~ret240; [L6234] havoc #t~ret240; [L6235] ~proto_group0~0 := ~tmp___0~8; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~8!base=0, ~tmp___0~8!offset=0, ~tmp~19!base=0, ~tmp~19!offset=0] [L6347] RET call ldv_initialize_hdlc_proto_3(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6351] COND FALSE !(0 != ~ldv_retval_0~0) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6318] assume -2147483648 <= #t~nondet252 && #t~nondet252 <= 2147483647; [L6318] ~tmp___6~1 := #t~nondet252; [L6318] havoc #t~nondet252; [L6320] #t~switch253 := 0 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=false, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND FALSE !(#t~switch253) [L6327] #t~switch253 := #t~switch253 || 1 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=false, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND FALSE !(#t~switch253) [L6369] #t~switch253 := #t~switch253 || 2 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND TRUE #t~switch253 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp~20!base=0, ~tmp~20!offset=0] [L6370] COND TRUE 0 != ~ldv_state_variable_3~0 [L6371] assume -2147483648 <= #t~nondet257 && #t~nondet257 <= 2147483647; [L6371] ~tmp___8~0 := #t~nondet257; [L6371] havoc #t~nondet257; [L6373] #t~switch258 := 0 == ~tmp___8~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6372-L6541] COND FALSE !(#t~switch258) [L6381] #t~switch258 := #t~switch258 || 1 == ~tmp___8~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6372-L6541] COND FALSE !(#t~switch258) [L6413] #t~switch258 := #t~switch258 || 2 == ~tmp___8~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6372-L6541] COND FALSE !(#t~switch258) [L6445] #t~switch258 := #t~switch258 || 3 == ~tmp___8~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=false, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6372-L6541] COND FALSE !(#t~switch258) [L6453] #t~switch258 := #t~switch258 || 4 == ~tmp___8~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6372-L6541] COND TRUE #t~switch258 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6454] COND FALSE !(4 == ~ldv_state_variable_3~0) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6460] COND TRUE 1 == ~ldv_state_variable_3~0 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6461] CALL call #t~ret270 := ppp_rx(~proto_group0~0); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5863-L6001] ~skb := #in~skb; [L5865] havoc ~hdr~0; [L5866] havoc ~dev~0; [L5867] havoc ~ppp~2; [L5868] havoc ~tmp~15; [L5869] havoc ~proto___0~1; [L5870] havoc ~cp~1; [L5871] havoc ~flags~0; [L5872] havoc ~len~1; [L5873] havoc ~pid~0; [L5874] havoc ~tmp___0~5; [L5875] havoc ~tmp___1~1; [L5876] havoc ~tmp___2~3; [L5877] havoc ~tmp___3~1; [L5878] havoc ~tmp___4~2; [L5881] FCALL call #t~mem149 := read~$Pointer$({ base: ~skb!base, offset: 232 + ~skb!offset }, 8); [L5881] ~hdr~0 := #t~mem149; [L5881] havoc #t~mem149; [L5882] FCALL call #t~mem150 := read~$Pointer$({ base: ~skb!base, offset: 32 + ~skb!offset }, 8); [L5882] ~dev~0 := #t~mem150; [L5882] havoc #t~mem150; VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0] [L5883] CALL call #t~ret151 := get_ppp(~dev~0); VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5412-L5420] ~dev := #in~dev; [L5414] havoc ~tmp~9; VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5417] CALL call #t~ret59 := dev_to_hdlc(~dev); VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5400-L5408] ~dev := #in~dev; [L5402] havoc ~tmp~8; VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5405] CALL call #t~ret55 := netdev_priv(~dev); VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5348-L5355] ~dev := #in~dev; [L5353] #res := { base: ~dev!base, offset: 3264 + ~dev!offset }; VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #res!base=4113, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5405] RET call #t~ret55 := netdev_priv(~dev); VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~ret55!base=4113, #t~ret55!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5405] ~tmp~8 := #t~ret55; [L5405] havoc #t~ret55; [L5406] #res := ~tmp~8; VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #res!base=4113, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~8!base=4113, ~tmp~8!offset=0] [L5417] RET call #t~ret59 := dev_to_hdlc(~dev); VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #t~ret59!base=4113, #t~ret59!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5417] ~tmp~9 := #t~ret59; [L5417] havoc #t~ret59; [L5418] FCALL call #t~mem60 := read~$Pointer$({ base: ~tmp~9!base, offset: 100 + ~tmp~9!offset }, 8); [L5418] #res := #t~mem60; [L5418] havoc #t~mem60; VAL [#in~dev!base=4113, #in~dev!offset=-3264, #NULL!base=0, #NULL!offset=0, #res!base=4174, #res!offset=-435, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev!base=4113, ~dev!offset=-3264, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~9!base=4113, ~tmp~9!offset=0] [L5883] RET call #t~ret151 := get_ppp(~dev~0); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~ret151!base=4174, #t~ret151!offset=-435, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0] [L5883] ~tmp~15 := #t~ret151; [L5883] havoc #t~ret151; [L5884] ~ppp~2 := ~tmp~15; VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5885] CALL call #t~ret152 := spinlock_check({ base: ~ppp~2!base, offset: 435 + ~ppp~2!offset }); VAL [#in~lock!base=4174, #in~lock!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5132-L5139] ~lock := #in~lock; [L5137] #res := { base: ~lock!base, offset: ~lock!offset }; VAL [#in~lock!base=4174, #in~lock!offset=0, #NULL!base=0, #NULL!offset=0, #res!base=4174, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~lock!base=4174, ~lock!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5885] RET call #t~ret152 := spinlock_check({ base: ~ppp~2!base, offset: 435 + ~ppp~2!offset }); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~ret152!base=4174, #t~ret152!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5885] ~tmp___0~5 := #t~ret152; [L5885] havoc #t~ret152; [L5886] FCALL call #t~ret153 := _raw_spin_lock_irqsave(~tmp___0~5); [L5886] ~flags~0 := #t~ret153; [L5886] havoc #t~ret153; [L5887] FCALL call #t~mem154 := read~int({ base: ~skb!base, offset: 104 + ~skb!offset }, 4); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~mem154=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5887] COND TRUE #t~mem154 % 4294967296 <= 3 [L5887] havoc #t~mem154; VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5994] FCALL call #t~mem193 := read~int({ base: ~dev~0!base, offset: 292 + ~dev~0!offset }, 8); [L5994] FCALL call write~int(1 + #t~mem193, { base: ~dev~0!base, offset: 292 + ~dev~0!offset }, 8); [L5994] havoc #t~mem193; VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5996] CALL call spin_unlock_irqrestore({ base: ~ppp~2!base, offset: 435 + ~ppp~2!offset }, ~flags~0); VAL [#in~flags=4124, #in~lock!base=4174, #in~lock!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5140-L5148] ~lock := #in~lock; [L5140-L5148] ~flags := #in~flags; [L5145] FCALL call _raw_spin_unlock_irqrestore({ base: ~lock!base, offset: ~lock!offset }, ~flags); VAL [#in~flags=4124, #in~lock!base=4174, #in~lock!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~flags=4124, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~lock!base=4174, ~lock!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5996] RET call spin_unlock_irqrestore({ base: ~ppp~2!base, offset: 435 + ~ppp~2!offset }, ~flags~0); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~flags~0=4124, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5997] CALL call dev_kfree_skb_any(~skb); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5358-L5366] ~skb := #in~skb; [L5363] FCALL call __dev_kfree_skb_any(~skb, 1); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0] [L5997] RET call dev_kfree_skb_any(~skb); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~flags~0=4124, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5998] CALL call ppp_tx_flush(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5519] havoc ~skb~0; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5526] CALL call #t~ret81 := ldv_skb_dequeue_12(~#tx_queue~0); VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6623-L6631] ~ldv_func_arg1 := #in~ldv_func_arg1; [L6625] havoc ~tmp~21; VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~ldv_func_arg1!base=4146, ~ldv_func_arg1!offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6628] CALL call #t~ret283 := ldv_skb_alloc(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6839] havoc ~skb~2; [L6840] havoc ~tmp___7~3; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6843] CALL call #t~ret293 := ldv_zalloc(248); VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0] [L5261] COND FALSE !(0 != ~tmp___0~1) [L5264] FCALL call #t~malloc39 := #Ultimate.alloc((if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296)); VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #t~malloc39!base=1, #t~malloc39!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0] [L5264] CALL call #Ultimate.meminit(#t~malloc39, 1, (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296), (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296)); VAL [#amountOfFields=1, #NULL!base=0, #NULL!offset=0, #product=248, #ptr!base=1, #ptr!offset=0, #sizeOfFields=248, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [?] #memory_int := ~initToZeroAtPointerBaseAddress~int(#memory_int, #ptr!base); VAL [#amountOfFields=1, #NULL!base=0, #NULL!offset=0, #product=248, #ptr!base=1, #ptr!offset=0, #sizeOfFields=248, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5264] RET call #Ultimate.meminit(#t~malloc39, 1, (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296), (if ~size % 4294967296 % 4294967296 <= 2147483647 then ~size % 4294967296 % 4294967296 else ~size % 4294967296 % 4294967296 - 4294967296)); VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #t~malloc39!base=1, #t~malloc39!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0] [L5264] ~tmp~2 := #t~malloc39; [L5265] ~p~1 := ~tmp~2; [L5266] assume 0 != (if 0 != (~p~1!base + ~p~1!offset) % 18446744073709551616 then 1 else 0); [L5267] #res := ~p~1; VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #res!base=1, #res!offset=0, #t~malloc39!base=1, #t~malloc39!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~p~1!base=1, ~p~1!offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=0, ~tmp~2!base=1, ~tmp~2!offset=0] [L6843] RET call #t~ret293 := ldv_zalloc(248); VAL [#NULL!base=0, #NULL!offset=0, #t~ret293!base=1, #t~ret293!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6843] ~tmp___7~3 := #t~ret293; [L6843] havoc #t~ret293; [L6844] ~skb~2 := ~tmp___7~3; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~2!base=1, ~skb~2!offset=0, ~tmp___7~3!base=1, ~tmp___7~3!offset=0] [L6845] COND FALSE !(~skb~2 == { base: 0, offset: 0 }) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~2!base=1, ~skb~2!offset=0, ~tmp___7~3!base=1, ~tmp___7~3!offset=0] [L6848] CALL call ldv_set_add(~LDV_SKBS~0, ~skb~2); VAL [#in~e!base=1, #in~e!offset=0, #in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6692-L6719] ~set := #in~set; [L6692-L6719] ~e := #in~e; [L6694] havoc ~i~1; [L6697] ~i~1 := 0; VAL [#in~e!base=1, #in~e!offset=0, #in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~e!base=1, ~e!offset=0, ~i~1=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~set!base=0, ~set!offset=0] [L6698-L6710] COND FALSE !(false) VAL [#in~e!base=1, #in~e!offset=0, #in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~e!base=1, ~e!offset=0, ~i~1=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~set!base=0, ~set!offset=0] [L6699] COND FALSE !(~i~1 < ~last_index~0) VAL [#in~e!base=1, #in~e!offset=0, #in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~e!base=1, ~e!offset=0, ~i~1=0, ~last_index~0=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~set!base=0, ~set!offset=0] [L6711] COND TRUE ~last_index~0 < 15 [L6712] FCALL call write~$Pointer$(~e, { base: ~#set_impl~0!base, offset: ~#set_impl~0!offset + 8 * ~last_index~0 }, 8); [L6713] ~last_index~0 := 1 + ~last_index~0; VAL [#in~e!base=1, #in~e!offset=0, #in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~e!base=1, ~e!offset=0, ~i~1=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~set!base=0, ~set!offset=0] [L6848] RET call ldv_set_add(~LDV_SKBS~0, ~skb~2); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~2!base=1, ~skb~2!offset=0, ~tmp___7~3!base=1, ~tmp___7~3!offset=0] [L6849] #res := ~skb~2; VAL [#NULL!base=0, #NULL!offset=0, #res!base=1, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~2!base=1, ~skb~2!offset=0, ~tmp___7~3!base=1, ~tmp___7~3!offset=0] [L6628] RET call #t~ret283 := ldv_skb_alloc(); VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #t~ret283!base=1, #t~ret283!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~ldv_func_arg1!base=4146, ~ldv_func_arg1!offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6628] ~tmp~21 := #t~ret283; [L6628] havoc #t~ret283; [L6629] #res := ~tmp~21; VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #res!base=1, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~ldv_func_arg1!base=4146, ~ldv_func_arg1!offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~21!base=1, ~tmp~21!offset=0] [L5526] RET call #t~ret81 := ldv_skb_dequeue_12(~#tx_queue~0); VAL [#NULL!base=0, #NULL!offset=0, #t~ret81!base=1, #t~ret81!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5526] ~skb~0 := #t~ret81; [L5526] havoc #t~ret81; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~0!base=1, ~skb~0!offset=0] [L5527] COND TRUE 0 != (~skb~0!base + ~skb~0!offset) % 18446744073709551616 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~0!base=1, ~skb~0!offset=0] [L5524] FCALL call #t~ret80 := dev_queue_xmit(~skb~0); [L5524] assume -2147483648 <= #t~ret80 && #t~ret80 <= 2147483647; [L5524] havoc #t~ret80; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~0!base=1, ~skb~0!offset=0] [L5526] CALL call #t~ret81 := ldv_skb_dequeue_12(~#tx_queue~0); VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6623-L6631] ~ldv_func_arg1 := #in~ldv_func_arg1; [L6625] havoc ~tmp~21; VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~ldv_func_arg1!base=4146, ~ldv_func_arg1!offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6628] CALL call #t~ret283 := ldv_skb_alloc(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6839] havoc ~skb~2; [L6840] havoc ~tmp___7~3; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6843] CALL call #t~ret293 := ldv_zalloc(248); VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5253-L5270] ~size := #in~size; [L5255] havoc ~p~1; [L5256] havoc ~tmp~2; [L5257] havoc ~tmp___0~1; [L5260] assume -2147483648 <= #t~nondet38 && #t~nondet38 <= 2147483647; [L5260] ~tmp___0~1 := #t~nondet38; [L5260] havoc #t~nondet38; VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=1] [L5261] COND TRUE 0 != ~tmp___0~1 [L5262] #res := { base: 0, offset: 0 }; VAL [#in~size=248, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~size=248, ~tmp___0~1=1] [L6843] RET call #t~ret293 := ldv_zalloc(248); VAL [#NULL!base=0, #NULL!offset=0, #t~ret293!base=0, #t~ret293!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6843] ~tmp___7~3 := #t~ret293; [L6843] havoc #t~ret293; [L6844] ~skb~2 := ~tmp___7~3; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~2!base=0, ~skb~2!offset=0, ~tmp___7~3!base=0, ~tmp___7~3!offset=0] [L6845] COND TRUE ~skb~2 == { base: 0, offset: 0 } [L6846] #res := { base: 0, offset: 0 }; VAL [#NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~2!base=0, ~skb~2!offset=0, ~tmp___7~3!base=0, ~tmp___7~3!offset=0] [L6628] RET call #t~ret283 := ldv_skb_alloc(); VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #t~ret283!base=0, #t~ret283!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~ldv_func_arg1!base=4146, ~ldv_func_arg1!offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6628] ~tmp~21 := #t~ret283; [L6628] havoc #t~ret283; [L6629] #res := ~tmp~21; VAL [#in~ldv_func_arg1!base=4146, #in~ldv_func_arg1!offset=0, #NULL!base=0, #NULL!offset=0, #res!base=0, #res!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=1, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~ldv_func_arg1!base=4146, ~ldv_func_arg1!offset=0, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp~21!base=0, ~tmp~21!offset=0] [L5526] RET call #t~ret81 := ldv_skb_dequeue_12(~#tx_queue~0); VAL [#NULL!base=0, #NULL!offset=0, #t~ret81!base=0, #t~ret81!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~0!base=1, ~skb~0!offset=0] [L5526] ~skb~0 := #t~ret81; [L5526] havoc #t~ret81; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~0!base=0, ~skb~0!offset=0] [L5527] COND FALSE !(0 != (~skb~0!base + ~skb~0!offset) % 18446744073709551616) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb~0!base=0, ~skb~0!offset=0] [L5998] RET call ppp_tx_flush(); VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~flags~0=4124, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L5999] #res := 1; VAL [#in~skb!base=0, #in~skb!offset=0, #NULL!base=0, #NULL!offset=0, #res=1, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~dev~0!base=4113, ~dev~0!offset=-3264, ~flags~0=4124, ~hdr~0!base=4127, ~hdr~0!offset=4157, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ppp~2!base=4174, ~ppp~2!offset=-435, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~skb!base=0, ~skb!offset=0, ~tmp___0~5!base=4174, ~tmp___0~5!offset=0, ~tmp~15!base=4174, ~tmp~15!offset=-435] [L6461] RET call #t~ret270 := ppp_rx(~proto_group0~0); VAL [#NULL!base=0, #NULL!offset=0, #t~ret270=1, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6461] assume -2147483648 <= #t~ret270 && #t~ret270 <= 2147483647; [L6461] havoc #t~ret270; [L6462] ~ldv_state_variable_3~0 := 1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6466] COND FALSE !(3 == ~ldv_state_variable_3~0) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6472] COND FALSE !(2 == ~ldv_state_variable_3~0) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6478] COND FALSE !(5 == ~ldv_state_variable_3~0) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=2, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6318] assume -2147483648 <= #t~nondet252 && #t~nondet252 <= 2147483647; [L6318] ~tmp___6~1 := #t~nondet252; [L6318] havoc #t~nondet252; [L6320] #t~switch253 := 0 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=false, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND FALSE !(#t~switch253) [L6327] #t~switch253 := #t~switch253 || 1 == ~tmp___6~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6319-L6570] COND TRUE #t~switch253 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=1, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6328] COND TRUE 0 != ~ldv_state_variable_0~0 [L6329] assume -2147483648 <= #t~nondet254 && #t~nondet254 <= 2147483647; [L6329] ~tmp___7~1 := #t~nondet254; [L6329] havoc #t~nondet254; [L6331] #t~switch255 := 0 == ~tmp___7~1; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6330-L6363] COND TRUE #t~switch255 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6332] COND TRUE 3 == ~ldv_state_variable_0~0 && 0 == ~ref_cnt~0 VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6333] CALL call mod_exit(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6193] FCALL call unregister_hdlc_protocol(~#proto~0); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6333] RET call mod_exit(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=3, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6334] ~ldv_state_variable_0~0 := 2; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, #t~switch253=true, #t~switch255=true, #t~switch258=true, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~ldvarg0~0!base=0, ~ldvarg0~0!offset=0, ~ldvarg1~0=4110, ~ldvarg2~0!base=0, ~ldvarg2~0!offset=0, ~ldvarg3~0!base=0, ~ldvarg3~0!offset=0, ~ldvarg4~0=4173, ~ldvarg5~0!base=0, ~ldvarg5~0!offset=0, ~ldvarg6~0!base=0, ~ldvarg6~0!offset=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___0~9=4110, ~tmp___1~3=4173, ~tmp___2~5!base=0, ~tmp___2~5!offset=0, ~tmp___3~2!base=0, ~tmp___3~2!offset=0, ~tmp___4~3!base=0, ~tmp___4~3!offset=0, ~tmp___5~1!base=0, ~tmp___5~1!offset=0, ~tmp___6~1=1, ~tmp___7~1=0, ~tmp___8~0=4, ~tmp~20!base=0, ~tmp~20!offset=0] [L6574] CALL call ldv_check_final_state(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6916] havoc ~tmp___7~7; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6919] CALL call #t~ret297 := ldv_set_is_empty(~LDV_SKBS~0); VAL [#in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6785-L6792] ~set := #in~set; [L6790] #res := (if 0 == ~last_index~0 then 1 else 0); VAL [#in~set!base=0, #in~set!offset=0, #NULL!base=0, #NULL!offset=0, #res=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~set!base=0, ~set!offset=0] [L6919] RET call #t~ret297 := ldv_set_is_empty(~LDV_SKBS~0); VAL [#NULL!base=0, #NULL!offset=0, #t~ret297=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L6919] assume -2147483648 <= #t~ret297 && #t~ret297 <= 2147483647; [L6919] ~tmp___7~7 := #t~ret297; [L6919] havoc #t~ret297; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___7~7=0] [L6920-L6924] COND FALSE !(0 != ~tmp___7~7) VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0, ~tmp___7~7=0] [L6923] CALL call ldv_error(); VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5304] assert false; VAL [#NULL!base=0, #NULL!offset=0, #t~string114!base=4135, #t~string114!offset=0, #t~string121!base=4107, #t~string121!offset=0, #t~string211!base=4165, #t~string211!offset=0, #t~string22!base=4175, #t~string22!offset=0, #t~string237!base=4114, #t~string237!offset=0, #t~string64!base=4171, #t~string64!offset=0, #t~string65!base=4154, #t~string65!offset=0, #t~string66!base=4151, #t~string66!offset=0, #t~string84!base=4163, #t~string84!offset=0, old(~last_index~0)=0, old(~LDV_IN_INTERRUPT~0)=1, old(~ldv_retval_0~0)=0, old(~ldv_state_variable_0~0)=0, old(~ldv_state_variable_1~0)=0, old(~ldv_state_variable_2~0)=0, old(~ldv_state_variable_3~0)=0, old(~ldv_timer_list_1~0!base)=0, old(~ldv_timer_list_1~0!offset)=0, old(~ldv_timer_state_1~0)=0, old(~proto_group0~0!base)=0, old(~proto_group0~0!offset)=0, old(~proto_group1~0!base)=0, old(~proto_group1~0!offset)=0, old(~ref_cnt~0)=0, ~#__this_module~0!base=4178, ~#__this_module~0!offset=4142, ~#cp_table~0!base=4119, ~#cp_table~0!offset=0, ~#ppp_header_ops~0!base=4133, ~#ppp_header_ops~0!offset=0, ~#proto~0!base=4139, ~#proto~0!offset=0, ~#set_impl~0!base=4156, ~#set_impl~0!offset=0, ~#tx_queue~0!base=4146, ~#tx_queue~0!offset=0, ~last_index~0=1, ~LDV_IN_INTERRUPT~0=1, ~ldv_retval_0~0=0, ~LDV_SKBS~0!base=0, ~LDV_SKBS~0!offset=0, ~ldv_state_variable_0~0=2, ~ldv_state_variable_1~0=1, ~ldv_state_variable_2~0=1, ~ldv_state_variable_3~0=1, ~ldv_timer_list_1~0!base=0, ~ldv_timer_list_1~0!offset=0, ~ldv_timer_state_1~0=0, ~proto_group0~0!base=0, ~proto_group0~0!offset=0, ~proto_group1~0!base=0, ~proto_group1~0!offset=0, ~ref_cnt~0=0] [L5333] int LDV_IN_INTERRUPT = 1; [L5335] int ldv_state_variable_0 ; [L5336] int ldv_state_variable_3 ; [L5337] int ldv_timer_state_1 = 0; [L5338] int ldv_state_variable_2 ; [L5340] int ref_cnt ; [L5341] int ldv_state_variable_1 ; [L5595-L5621] static int cp_table[13U][7U] = { { 163, 16, 16, 16, 16, 16, 16}, { 16, 0, 0, 0, 0, 0, 0}, { 16, 16, 1026, 131, 131, 133, 16}, { 16, 16, 1, 1, 1, 1, 16}, { 2048, 421, 2, 261, 262, 261, 389}, { 2048, 675, 2, 515, 516, 515, 643}, { 2048, 2049, 2, 36, 131, 6, 131}, { 2048, 2049, 2, 163, 131, 165, 131}, { 2048, 2049, 2050, 2051, 2051, 2051, 2114}, { 0, 1, 1, 3, 3, 5, 131}, { 4096, 4097, 4098, 4099, 4100, 4101, 4102}, { 0, 1, 2, 3, 3, 5, 6}, { 0, 1, 1, 1, 1, 1, 1058}}; [L6197] int ldv_retval_0 ; [L6679] int last_index = 0; [L5334] struct net_device *proto_group1 ; [L5339] struct sk_buff *proto_group0 ; [L5342] struct timer_list *ldv_timer_list_1 ; [L5410] static struct sk_buff_head tx_queue ; [L6104-L6106] static struct hdlc_proto proto = {0, & ppp_close, & ppp_start, & ppp_stop, 0, & ppp_ioctl, & ppp_type_trans, & ppp_rx, 0, & __this_module, 0}; [L6107] static struct header_ops const ppp_header_ops = {& ppp_hard_header, 0, 0, 0, 0}; [L6678] Element set_impl[15] ; [L6836] Set LDV_SKBS ; VAL [\old(cp_table)=null, \old(cp_table)=null, \old(last_index)=4160, \old(LDV_IN_INTERRUPT)=4120, \old(ldv_retval_0)=4116, \old(LDV_SKBS)=4104, \old(LDV_SKBS)=4125, \old(ldv_state_variable_0)=4129, \old(ldv_state_variable_1)=4162, \old(ldv_state_variable_2)=4149, \old(ldv_state_variable_3)=4179, \old(ldv_timer_list_1)=4170, \old(ldv_timer_list_1)=4169, \old(ldv_timer_state_1)=4177, \old(ppp_header_ops)=null, \old(ppp_header_ops)=null, \old(proto)=null, \old(proto)=null, \old(proto_group0)=4141, \old(proto_group0)=4145, \old(proto_group1)=4134, \old(proto_group1)=4122, \old(ref_cnt)=4147, \old(set_impl)=null, \old(set_impl)=null, \old(tx_queue)=null, \old(tx_queue)=null, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6277] struct ifreq *ldvarg0 ; [L6278] void *tmp ; [L6279] unsigned int ldvarg1 ; [L6280] unsigned int tmp___0 ; [L6281] unsigned short ldvarg4 ; [L6282] unsigned short tmp___1 ; [L6283] struct sk_buff *ldvarg3 ; [L6284] void *tmp___2 ; [L6285] struct net_device *ldvarg5 ; [L6286] void *tmp___3 ; [L6287] void *ldvarg2 ; [L6288] void *tmp___4 ; [L6289] void *ldvarg6 ; [L6290] void *tmp___5 ; [L6291] int tmp___6 ; [L6292] int tmp___7 ; [L6293] int tmp___8 ; [L6294] int tmp___9 ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6297] CALL, EXPR ldv_zalloc(40UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=40, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=40, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=40, tmp___0=1, tx_queue={4146:0}] [L6297] RET, EXPR ldv_zalloc(40UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6297] tmp = ldv_zalloc(40UL) [L6298] ldvarg0 = (struct ifreq *)tmp [L6299] tmp___0 = __VERIFIER_nondet_uint() [L6300] ldvarg1 = tmp___0 [L6301] tmp___1 = __VERIFIER_nondet_ushort() [L6302] ldvarg4 = tmp___1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg4=4173, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tx_queue={4146:0}] [L6303] CALL, EXPR ldv_zalloc(232UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=232, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=232, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=232, tmp___0=1, tx_queue={4146:0}] [L6303] RET, EXPR ldv_zalloc(232UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=4110, ldvarg4=4173, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tx_queue={4146:0}] [L6303] tmp___2 = ldv_zalloc(232UL) [L6304] ldvarg3 = (struct sk_buff *)tmp___2 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg3={0:0}, ldvarg4=4173, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tx_queue={4146:0}] [L6305] CALL, EXPR ldv_zalloc(3264UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=3264, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=3264, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=3264, tmp___0=1, tx_queue={4146:0}] [L6305] RET, EXPR ldv_zalloc(3264UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=4110, ldvarg3={0:0}, ldvarg4=4173, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tx_queue={4146:0}] [L6305] tmp___3 = ldv_zalloc(3264UL) [L6306] ldvarg5 = (struct net_device *)tmp___3 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tx_queue={4146:0}] [L6307] CALL, EXPR ldv_zalloc(1UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=1, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=1, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=1, tmp___0=1, tx_queue={4146:0}] [L6307] RET, EXPR ldv_zalloc(1UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4110, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tx_queue={4146:0}] [L6307] tmp___4 = ldv_zalloc(1UL) [L6308] ldvarg2 = tmp___4 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tx_queue={4146:0}] [L6309] CALL, EXPR ldv_zalloc(1UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=1, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=1, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=1, tmp___0=1, tx_queue={4146:0}] [L6309] RET, EXPR ldv_zalloc(1UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tx_queue={4146:0}] [L6309] tmp___5 = ldv_zalloc(1UL) [L6310] ldvarg6 = tmp___5 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tx_queue={4146:0}] [L6311] CALL ldv_initialize() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6858] CALL ldv_set_init(LDV_SKBS) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6686] set = set_impl [L6687] last_index = 0 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={4156:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6858] RET ldv_set_init(LDV_SKBS) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6311] RET ldv_initialize() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tx_queue={4146:0}] [L6312] ldv_state_variable_1 = 1 [L6313] ref_cnt = 0 [L6314] ldv_state_variable_0 = 1 [L6315] ldv_state_variable_3 = 0 [L6316] ldv_state_variable_2 = 0 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tx_queue={4146:0}] [L6318] tmp___6 = __VERIFIER_nondet_int() [L6320] case 0: [L6327] case 1: VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tx_queue={4146:0}] [L6328] COND TRUE ldv_state_variable_0 != 0 [L6329] tmp___7 = __VERIFIER_nondet_int() [L6331] case 0: [L6340] case 1: VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tx_queue={4146:0}] [L6341] COND TRUE ldv_state_variable_0 == 1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tx_queue={4146:0}] [L6342] CALL, EXPR mod_init() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6183] CALL skb_queue_head_init(& tx_queue) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5191] struct lock_class_key __key ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __key={4167:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5194] CALL spinlock_check(& list->lock) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, lock={4146:20}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5137] return (& lock->ldv_6338.rlock); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={4146:20}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, lock={4146:20}, lock={4146:20}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5194] RET spinlock_check(& list->lock) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __key={4167:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, spinlock_check(& list->lock)={4146:20}, tx_queue={4146:0}] [L5196] CALL __skb_queue_head_init(list) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5179] struct sk_buff *tmp ; [L5182] tmp = (struct sk_buff *)list [L5183] list->next = tmp [L5184] list->prev = tmp [L5185] list->qlen = 0U VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={4146:0}, tx_queue={4146:0}] [L5196] RET __skb_queue_head_init(list) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __key={4167:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5197] return; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6183] RET skb_queue_head_init(& tx_queue) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6185] return (0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6342] RET, EXPR mod_init() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, mod_init()=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tx_queue={4146:0}] [L6342] ldv_retval_0 = mod_init() [L6343] COND TRUE ldv_retval_0 == 0 [L6344] ldv_state_variable_0 = 3 [L6345] ldv_state_variable_2 = 1 [L6346] ldv_state_variable_3 = 1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tx_queue={4146:0}] [L6347] CALL ldv_initialize_hdlc_proto_3() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6228] void *tmp ; [L6229] void *tmp___0 ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6232] CALL, EXPR ldv_zalloc(3264UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=3264, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=3264, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=3264, tmp___0=1, tx_queue={4146:0}] [L6232] RET, EXPR ldv_zalloc(3264UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6232] tmp = ldv_zalloc(3264UL) [L6233] proto_group1 = (struct net_device *)tmp VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tx_queue={4146:0}] [L6234] CALL, EXPR ldv_zalloc(232UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=232, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=232, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=232, tmp___0=1, tx_queue={4146:0}] [L6234] RET, EXPR ldv_zalloc(232UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tx_queue={4146:0}] [L6234] tmp___0 = ldv_zalloc(232UL) [L6235] proto_group0 = (struct sk_buff *)tmp___0 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0={0:0}, tx_queue={4146:0}] [L6347] RET ldv_initialize_hdlc_proto_3() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tx_queue={4146:0}] [L6351] COND FALSE !(ldv_retval_0 != 0) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tx_queue={4146:0}] [L6318] tmp___6 = __VERIFIER_nondet_int() [L6320] case 0: [L6327] case 1: [L6369] case 2: VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tx_queue={4146:0}] [L6370] COND TRUE ldv_state_variable_3 != 0 [L6371] tmp___8 = __VERIFIER_nondet_int() [L6373] case 0: [L6381] case 1: [L6413] case 2: [L6445] case 3: [L6453] case 4: VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6454] COND FALSE !(ldv_state_variable_3 == 4) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6460] COND TRUE ldv_state_variable_3 == 1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6461] CALL ppp_rx(proto_group0) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, tx_queue={4146:0}] [L5865] struct hdlc_header *hdr ; [L5866] struct net_device *dev ; [L5867] struct ppp *ppp ; [L5868] struct ppp *tmp ; [L5869] struct proto *proto___0 ; [L5870] struct cp_header *cp ; [L5871] unsigned long flags ; [L5872] unsigned int len ; [L5873] u16 pid ; [L5874] raw_spinlock_t *tmp___0 ; [L5875] unsigned char *tmp___1 ; [L5876] __u16 tmp___2 ; [L5877] __u16 tmp___3 ; [L5878] __u16 tmp___4 ; [L5881] EXPR skb->data [L5881] hdr = (struct hdlc_header *)skb->data [L5882] EXPR skb->dev [L5882] dev = skb->dev [L5883] CALL, EXPR get_ppp(dev) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5414] struct hdlc_device *tmp ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5417] CALL, EXPR dev_to_hdlc(dev) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5402] void *tmp ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5405] CALL, EXPR netdev_priv((struct net_device const *)dev) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5353] return ((void *)dev + 3264U); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={4113:0}, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5405] RET, EXPR netdev_priv((struct net_device const *)dev) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, netdev_priv((struct net_device const *)dev)={4113:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5405] tmp = netdev_priv((struct net_device const *)dev) [L5406] return ((struct hdlc_device *)tmp); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={4113:0}, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={4113:0}, tx_queue={4146:0}] [L5417] RET, EXPR dev_to_hdlc(dev) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, dev={4113:-3264}, dev_to_hdlc(dev)={4113:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5417] tmp = dev_to_hdlc(dev) [L5418] EXPR tmp->state [L5418] return ((struct ppp *)tmp->state); [L5883] RET, EXPR get_ppp(dev) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, get_ppp(dev)={4174:-435}, hdr={4127:4157}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, tx_queue={4146:0}] [L5883] tmp = get_ppp(dev) [L5884] ppp = tmp VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, hdr={4127:4157}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, tmp={4174:-435}, tx_queue={4146:0}] [L5885] CALL, EXPR spinlock_check(& ppp->lock) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, lock={4174:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5137] return (& lock->ldv_6338.rlock); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={4174:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, lock={4174:0}, lock={4174:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5885] RET, EXPR spinlock_check(& ppp->lock) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, hdr={4127:4157}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, spinlock_check(& ppp->lock)={4174:0}, tmp={4174:-435}, tx_queue={4146:0}] [L5885] tmp___0 = spinlock_check(& ppp->lock) [L5886] flags = _raw_spin_lock_irqsave(tmp___0) [L5887] EXPR skb->len VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, hdr={4127:4157}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, skb->len=0, tmp={4174:-435}, tmp___0={4174:0}, tx_queue={4146:0}] [L5887] COND TRUE skb->len <= 3U [L5994] EXPR dev->stats.rx_errors [L5994] dev->stats.rx_errors = dev->stats.rx_errors + 1UL [L5996] CALL spin_unlock_irqrestore(& ppp->lock, flags) VAL [\old(flags)=4124, \old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, lock={4174:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5996] RET spin_unlock_irqrestore(& ppp->lock, flags) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, flags=4124, hdr={4127:4157}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, tmp={4174:-435}, tmp___0={4174:0}, tx_queue={4146:0}] [L5997] CALL dev_kfree_skb_any(skb) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, tx_queue={4146:0}] [L5997] RET dev_kfree_skb_any(skb) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, flags=4124, hdr={4127:4157}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, tmp={4174:-435}, tmp___0={4174:0}, tx_queue={4146:0}] [L5998] CALL ppp_tx_flush() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5519] struct sk_buff *skb ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5526] CALL, EXPR ldv_skb_dequeue_12(& tx_queue) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6625] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, ldv_func_arg1={4146:0}, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6628] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6839] void *skb ; [L6840] void *tmp___7 ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6843] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=248, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND FALSE !(tmp___0 != 0) [L5264] EXPR, FCALL calloc(1UL, size) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=248, __this_module={4178:4142}, calloc(1UL, size)={1:0}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=248, tmp___0=0, tx_queue={4146:0}] [L5264] tmp = calloc(1UL, size) [L5265] p = tmp [L5267] return (p); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=248, \result={1:0}, __this_module={4178:4142}, calloc(1UL, size)={1:0}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={1:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=248, tmp={1:0}, tmp___0=0, tx_queue={4146:0}] [L6843] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={1:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6843] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6844] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={1:0}, tmp___7={1:0}, tx_queue={4146:0}] [L6845] COND FALSE !(! skb) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={1:0}, tmp___7={1:0}, tx_queue={4146:0}] [L6848] CALL ldv_set_add(LDV_SKBS, skb) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, e={1:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6694] int i ; [L6697] i = 0 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, e={1:0}, e={1:0}, i=0, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6698] COND TRUE 1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, e={1:0}, e={1:0}, i=0, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6699] COND FALSE !(i < last_index) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, e={1:0}, e={1:0}, i=0, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6711] COND TRUE last_index < 15 [L6712] set_impl[last_index] = e [L6713] last_index = last_index + 1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, e={1:0}, e={1:0}, i=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6848] RET ldv_set_add(LDV_SKBS, skb) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={1:0}, tmp___7={1:0}, tx_queue={4146:0}] [L6849] return (skb); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={1:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={1:0}, tmp___7={1:0}, tx_queue={4146:0}] [L6628] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, ldv_func_arg1={4146:0}, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, ldv_skb_alloc()={1:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6628] tmp = ldv_skb_alloc() [L6629] return (tmp); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={1:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, ldv_func_arg1={4146:0}, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={1:0}, tx_queue={4146:0}] [L5526] RET, EXPR ldv_skb_dequeue_12(& tx_queue) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, ldv_skb_dequeue_12(& tx_queue)={1:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5526] skb = ldv_skb_dequeue_12(& tx_queue) [L5527] COND TRUE (unsigned long )skb != (unsigned long )((struct sk_buff *)0) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={1:0}, tx_queue={4146:0}] [L5526] CALL, EXPR ldv_skb_dequeue_12(& tx_queue) VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6625] struct sk_buff *tmp ; VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, ldv_func_arg1={4146:0}, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6628] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6839] void *skb ; [L6840] void *tmp___7 ; VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6843] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=248, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=248, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=248, tmp___0=1, tx_queue={4146:0}] [L6843] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6843] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6844] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, tmp___7={0:0}, tx_queue={4146:0}] [L6845] COND TRUE ! skb [L6846] return ((void *)0); VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, tmp___7={0:0}, tx_queue={4146:0}] [L6628] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, ldv_func_arg1={4146:0}, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, ldv_skb_alloc()={0:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6628] tmp = ldv_skb_alloc() [L6629] return (tmp); VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, ldv_func_arg1={4146:0}, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tx_queue={4146:0}] [L5526] RET, EXPR ldv_skb_dequeue_12(& tx_queue) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, ldv_skb_dequeue_12(& tx_queue)={0:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={1:0}, tx_queue={4146:0}] [L5526] skb = ldv_skb_dequeue_12(& tx_queue) [L5527] COND FALSE !((unsigned long )skb != (unsigned long )((struct sk_buff *)0)) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, tx_queue={4146:0}] [L5998] RET ppp_tx_flush() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, flags=4124, hdr={4127:4157}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, tmp={4174:-435}, tmp___0={4174:0}, tx_queue={4146:0}] [L5999] return (1); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result=1, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, flags=4124, hdr={4127:4157}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, tmp={4174:-435}, tmp___0={4174:0}, tx_queue={4146:0}] [L6461] RET ppp_rx(proto_group0) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, ppp_rx(proto_group0)=1, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6462] ldv_state_variable_3 = 1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6466] COND FALSE !(ldv_state_variable_3 == 3) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6472] COND FALSE !(ldv_state_variable_3 == 2) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6478] COND FALSE !(ldv_state_variable_3 == 5) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6318] tmp___6 = __VERIFIER_nondet_int() [L6320] case 0: [L6327] case 1: VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6328] COND TRUE ldv_state_variable_0 != 0 [L6329] tmp___7 = __VERIFIER_nondet_int() [L6331] case 0: VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0, tmp___8=4, tx_queue={4146:0}] [L6332] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0, tmp___8=4, tx_queue={4146:0}] [L6333] CALL mod_exit() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6333] RET mod_exit() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0, tmp___8=4, tx_queue={4146:0}] [L6334] ldv_state_variable_0 = 2 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0, tmp___8=4, tx_queue={4146:0}] [L6574] CALL ldv_check_final_state() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6916] int tmp___7 ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6919] CALL, EXPR ldv_set_is_empty(LDV_SKBS) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6790] return (last_index == 0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6919] RET, EXPR ldv_set_is_empty(LDV_SKBS) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, ldv_set_is_empty(LDV_SKBS)=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6919] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6920] COND FALSE !(\read(tmp___7)) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp___7=0, tx_queue={4146:0}] [L6923] CALL ldv_error() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5304] __VERIFIER_error() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] ----- [2018-11-23 05:15:48,258 INFO L145 WitnessManager]: Wrote witness to /tmp/vcloud-vcloud-master/worker/working_dir_6afc13db-5623-4e5c-8ab8-d57643d7a344/bin-2019/uautomizer/witness.graphml [2018-11-23 05:15:48,258 INFO L132 PluginConnector]: ------------------------ END Witness Printer---------------------------- [2018-11-23 05:15:48,259 INFO L168 Benchmark]: Toolchain (without parser) took 62425.70 ms. Allocated memory was 1.0 GB in the beginning and 1.6 GB in the end (delta: 539.0 MB). Free memory was 951.2 MB in the beginning and 869.3 MB in the end (delta: 81.9 MB). Peak memory consumption was 620.8 MB. Max. memory is 11.5 GB. [2018-11-23 05:15:48,260 INFO L168 Benchmark]: CDTParser took 0.16 ms. Allocated memory is still 1.0 GB. Free memory is still 985.6 MB. There was no memory consumed. Max. memory is 11.5 GB. [2018-11-23 05:15:48,260 INFO L168 Benchmark]: CACSL2BoogieTranslator took 1221.54 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 156.2 MB). Free memory was 951.2 MB in the beginning and 1.1 GB in the end (delta: -116.8 MB). Peak memory consumption was 97.2 MB. Max. memory is 11.5 GB. [2018-11-23 05:15:48,261 INFO L168 Benchmark]: Boogie Procedure Inliner took 48.12 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 2.7 MB). Peak memory consumption was 2.7 MB. Max. memory is 11.5 GB. [2018-11-23 05:15:48,261 INFO L168 Benchmark]: Boogie Preprocessor took 84.26 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 10.7 MB). Peak memory consumption was 10.7 MB. Max. memory is 11.5 GB. [2018-11-23 05:15:48,261 INFO L168 Benchmark]: RCFGBuilder took 1322.40 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: -27.6 MB). Peak memory consumption was 192.9 MB. Max. memory is 11.5 GB. [2018-11-23 05:15:48,261 INFO L168 Benchmark]: TraceAbstraction took 21097.61 ms. Allocated memory was 1.2 GB in the beginning and 1.6 GB in the end (delta: 382.7 MB). Free memory was 1.1 GB in the beginning and 1.4 GB in the end (delta: -268.3 MB). Peak memory consumption was 629.8 MB. Max. memory is 11.5 GB. [2018-11-23 05:15:48,262 INFO L168 Benchmark]: Witness Printer took 38648.55 ms. Allocated memory is still 1.6 GB. Free memory was 1.4 GB in the beginning and 869.3 MB in the end (delta: 481.2 MB). Peak memory consumption was 481.2 MB. Max. memory is 11.5 GB. [2018-11-23 05:15:48,263 INFO L336 ainManager$Toolchain]: ####################### End [Toolchain 1] ####################### --- Results --- * Results from de.uni_freiburg.informatik.ultimate.core: - StatisticsResult: Toolchain Benchmarks Benchmark results are: * CDTParser took 0.16 ms. Allocated memory is still 1.0 GB. Free memory is still 985.6 MB. There was no memory consumed. Max. memory is 11.5 GB. * CACSL2BoogieTranslator took 1221.54 ms. Allocated memory was 1.0 GB in the beginning and 1.2 GB in the end (delta: 156.2 MB). Free memory was 951.2 MB in the beginning and 1.1 GB in the end (delta: -116.8 MB). Peak memory consumption was 97.2 MB. Max. memory is 11.5 GB. * Boogie Procedure Inliner took 48.12 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 2.7 MB). Peak memory consumption was 2.7 MB. Max. memory is 11.5 GB. * Boogie Preprocessor took 84.26 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: 10.7 MB). Peak memory consumption was 10.7 MB. Max. memory is 11.5 GB. * RCFGBuilder took 1322.40 ms. Allocated memory is still 1.2 GB. Free memory was 1.1 GB in the beginning and 1.1 GB in the end (delta: -27.6 MB). Peak memory consumption was 192.9 MB. Max. memory is 11.5 GB. * TraceAbstraction took 21097.61 ms. Allocated memory was 1.2 GB in the beginning and 1.6 GB in the end (delta: 382.7 MB). Free memory was 1.1 GB in the beginning and 1.4 GB in the end (delta: -268.3 MB). Peak memory consumption was 629.8 MB. Max. memory is 11.5 GB. * Witness Printer took 38648.55 ms. Allocated memory is still 1.6 GB. Free memory was 1.4 GB in the beginning and 869.3 MB in the end (delta: 481.2 MB). Peak memory consumption was 481.2 MB. Max. memory is 11.5 GB. * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.cacsl2boogietranslator: - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4117 could not be translated for associated CType STRUCT~~sk_buff_head?next~*sk_buff?prev~*sk_buff?qlen~~__u32~0?lock~~spinlock_t~0# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4118 could not be translated for associated CType ARRAY#_13_~ARRAY#_7_~INT## - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4168 could not be translated for associated CType ARRAY#_15_~~Element~0# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4123 could not be translated for associated CType ARRAY#_15_~~Element~0# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4159 could not be translated for associated CType STRUCT~~sk_buff_head?next~*sk_buff?prev~*sk_buff?qlen~~__u32~0?lock~~spinlock_t~0# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4140 could not be translated for associated CType ARRAY#_13_~ARRAY#_7_~INT## - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4137 could not be translated for associated CType STRUCT~~hdlc_proto?open~*((*net_device ) : INT)?close~*((*net_device ) : VOID)?start~*((*net_device ) : VOID)?stop~*((*net_device ) : VOID)?detach~*((*net_device ) : VOID)?ioctl~*((*net_device *ifreq ) : INT)?type_trans~*((*sk_buff *net_device ) : ~__be16~0)?netif_rx~*((*sk_buff ) : INT)?xmit~*((*sk_buff *net_device ) : ~netdev_tx_t~0)?module~*module?next~*hdlc_proto# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4152 could not be translated for associated CType STRUCT~~hdlc_proto?open~*((*net_device ) : INT)?close~*((*net_device ) : VOID)?start~*((*net_device ) : VOID)?stop~*((*net_device ) : VOID)?detach~*((*net_device ) : VOID)?ioctl~*((*net_device *ifreq ) : INT)?type_trans~*((*sk_buff *net_device ) : ~__be16~0)?netif_rx~*((*sk_buff ) : INT)?xmit~*((*sk_buff *net_device ) : ~netdev_tx_t~0)?module~*module?next~*hdlc_proto# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4126 could not be translated for associated CType STRUCT~~header_ops?create~*((*sk_buff *net_device USHORT *VOID *VOID UINT ) : INT)?parse~*((*sk_buff *UCHAR ) : INT)?rebuild~*((*sk_buff ) : INT)?cache~*((*neighbour *hh_cache ~__be16~0 ) : INT)?cache_update~*((*hh_cache *net_device *UCHAR ) : VOID)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4131 could not be translated for associated CType STRUCT~~header_ops?create~*((*sk_buff *net_device USHORT *VOID *VOID UINT ) : INT)?parse~*((*sk_buff *UCHAR ) : INT)?rebuild~*((*sk_buff ) : INT)?cache~*((*neighbour *hh_cache ~__be16~0 ) : INT)?cache_update~*((*hh_cache *net_device *UCHAR ) : VOID)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4152 could not be translated for associated CType STRUCT~~hdlc_proto?open~*((*net_device ) : INT)?close~*((*net_device ) : VOID)?start~*((*net_device ) : VOID)?stop~*((*net_device ) : VOID)?detach~*((*net_device ) : VOID)?ioctl~*((*net_device *ifreq ) : INT)?type_trans~*((*sk_buff *net_device ) : ~__be16~0)?netif_rx~*((*sk_buff ) : INT)?xmit~*((*sk_buff *net_device ) : ~netdev_tx_t~0)?module~*module?next~*hdlc_proto# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4140 could not be translated for associated CType ARRAY#_13_~ARRAY#_7_~INT## - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4123 could not be translated for associated CType ARRAY#_15_~~Element~0# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4131 could not be translated for associated CType STRUCT~~header_ops?create~*((*sk_buff *net_device USHORT *VOID *VOID UINT ) : INT)?parse~*((*sk_buff *UCHAR ) : INT)?rebuild~*((*sk_buff ) : INT)?cache~*((*neighbour *hh_cache ~__be16~0 ) : INT)?cache_update~*((*hh_cache *net_device *UCHAR ) : VOID)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4117 could not be translated for associated CType STRUCT~~sk_buff_head?next~*sk_buff?prev~*sk_buff?qlen~~__u32~0?lock~~spinlock_t~0# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4168 could not be translated for associated CType ARRAY#_15_~~Element~0# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4118 could not be translated for associated CType ARRAY#_13_~ARRAY#_7_~INT## - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4159 could not be translated for associated CType STRUCT~~sk_buff_head?next~*sk_buff?prev~*sk_buff?qlen~~__u32~0?lock~~spinlock_t~0# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4126 could not be translated for associated CType STRUCT~~header_ops?create~*((*sk_buff *net_device USHORT *VOID *VOID UINT ) : INT)?parse~*((*sk_buff *UCHAR ) : INT)?rebuild~*((*sk_buff ) : INT)?cache~*((*neighbour *hh_cache ~__be16~0 ) : INT)?cache_update~*((*hh_cache *net_device *UCHAR ) : VOID)# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: IntegerLiteral 4137 could not be translated for associated CType STRUCT~~hdlc_proto?open~*((*net_device ) : INT)?close~*((*net_device ) : VOID)?start~*((*net_device ) : VOID)?stop~*((*net_device ) : VOID)?detach~*((*net_device ) : VOID)?ioctl~*((*net_device *ifreq ) : INT)?type_trans~*((*sk_buff *net_device ) : ~__be16~0)?netif_rx~*((*sk_buff ) : INT)?xmit~*((*sk_buff *net_device ) : ~netdev_tx_t~0)?module~*module?next~*hdlc_proto# - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch253 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch255 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement - GenericResult: Unfinished Backtranslation Unfinished Backtranslation: Expression #t~switch258 has a C AST node but it is no IASTExpression: class org.eclipse.cdt.internal.core.dom.parser.c.CASTSwitchStatement * Results from de.uni_freiburg.informatik.ultimate.plugins.generator.traceabstraction: - CounterExampleResult [Line: 5304]: a call of __VERIFIER_error() is reachable a call of __VERIFIER_error() is reachable We found a FailurePath: [L5333] int LDV_IN_INTERRUPT = 1; [L5335] int ldv_state_variable_0 ; [L5336] int ldv_state_variable_3 ; [L5337] int ldv_timer_state_1 = 0; [L5338] int ldv_state_variable_2 ; [L5340] int ref_cnt ; [L5341] int ldv_state_variable_1 ; [L5595-L5621] static int cp_table[13U][7U] = { { 163, 16, 16, 16, 16, 16, 16}, { 16, 0, 0, 0, 0, 0, 0}, { 16, 16, 1026, 131, 131, 133, 16}, { 16, 16, 1, 1, 1, 1, 16}, { 2048, 421, 2, 261, 262, 261, 389}, { 2048, 675, 2, 515, 516, 515, 643}, { 2048, 2049, 2, 36, 131, 6, 131}, { 2048, 2049, 2, 163, 131, 165, 131}, { 2048, 2049, 2050, 2051, 2051, 2051, 2114}, { 0, 1, 1, 3, 3, 5, 131}, { 4096, 4097, 4098, 4099, 4100, 4101, 4102}, { 0, 1, 2, 3, 3, 5, 6}, { 0, 1, 1, 1, 1, 1, 1058}}; [L6197] int ldv_retval_0 ; [L6679] int last_index = 0; [L5334] struct net_device *proto_group1 ; [L5339] struct sk_buff *proto_group0 ; [L5342] struct timer_list *ldv_timer_list_1 ; [L5410] static struct sk_buff_head tx_queue ; [L6104-L6106] static struct hdlc_proto proto = {0, & ppp_close, & ppp_start, & ppp_stop, 0, & ppp_ioctl, & ppp_type_trans, & ppp_rx, 0, & __this_module, 0}; [L6107] static struct header_ops const ppp_header_ops = {& ppp_hard_header, 0, 0, 0, 0}; [L6678] Element set_impl[15] ; [L6836] Set LDV_SKBS ; VAL [\old(cp_table)=null, \old(cp_table)=null, \old(last_index)=4160, \old(LDV_IN_INTERRUPT)=4120, \old(ldv_retval_0)=4116, \old(LDV_SKBS)=4104, \old(LDV_SKBS)=4125, \old(ldv_state_variable_0)=4129, \old(ldv_state_variable_1)=4162, \old(ldv_state_variable_2)=4149, \old(ldv_state_variable_3)=4179, \old(ldv_timer_list_1)=4170, \old(ldv_timer_list_1)=4169, \old(ldv_timer_state_1)=4177, \old(ppp_header_ops)=null, \old(ppp_header_ops)=null, \old(proto)=null, \old(proto)=null, \old(proto_group0)=4145, \old(proto_group0)=4141, \old(proto_group1)=4134, \old(proto_group1)=4122, \old(ref_cnt)=4147, \old(set_impl)=null, \old(set_impl)=null, \old(tx_queue)=null, \old(tx_queue)=null, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6277] struct ifreq *ldvarg0 ; [L6278] void *tmp ; [L6279] unsigned int ldvarg1 ; [L6280] unsigned int tmp___0 ; [L6281] unsigned short ldvarg4 ; [L6282] unsigned short tmp___1 ; [L6283] struct sk_buff *ldvarg3 ; [L6284] void *tmp___2 ; [L6285] struct net_device *ldvarg5 ; [L6286] void *tmp___3 ; [L6287] void *ldvarg2 ; [L6288] void *tmp___4 ; [L6289] void *ldvarg6 ; [L6290] void *tmp___5 ; [L6291] int tmp___6 ; [L6292] int tmp___7 ; [L6293] int tmp___8 ; [L6294] int tmp___9 ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6297] CALL, EXPR ldv_zalloc(40UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=40, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=40, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=40, tmp___0=1, tx_queue={4146:0}] [L6297] RET, EXPR ldv_zalloc(40UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(40UL)={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6297] tmp = ldv_zalloc(40UL) [L6298] ldvarg0 = (struct ifreq *)tmp [L6299] tmp___0 = __VERIFIER_nondet_uint() [L6300] ldvarg1 = tmp___0 [L6301] tmp___1 = __VERIFIER_nondet_ushort() [L6302] ldvarg4 = tmp___1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg4=4173, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tx_queue={4146:0}] [L6303] CALL, EXPR ldv_zalloc(232UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=232, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=232, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=232, tmp___0=1, tx_queue={4146:0}] [L6303] RET, EXPR ldv_zalloc(232UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ldvarg0={0:0}, ldvarg1=4110, ldvarg4=4173, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tx_queue={4146:0}] [L6303] tmp___2 = ldv_zalloc(232UL) [L6304] ldvarg3 = (struct sk_buff *)tmp___2 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg3={0:0}, ldvarg4=4173, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tx_queue={4146:0}] [L6305] CALL, EXPR ldv_zalloc(3264UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=3264, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=3264, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=3264, tmp___0=1, tx_queue={4146:0}] [L6305] RET, EXPR ldv_zalloc(3264UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ldvarg0={0:0}, ldvarg1=4110, ldvarg3={0:0}, ldvarg4=4173, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tx_queue={4146:0}] [L6305] tmp___3 = ldv_zalloc(3264UL) [L6306] ldvarg5 = (struct net_device *)tmp___3 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tx_queue={4146:0}] [L6307] CALL, EXPR ldv_zalloc(1UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=1, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=1, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=1, tmp___0=1, tx_queue={4146:0}] [L6307] RET, EXPR ldv_zalloc(1UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4110, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tx_queue={4146:0}] [L6307] tmp___4 = ldv_zalloc(1UL) [L6308] ldvarg2 = tmp___4 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tx_queue={4146:0}] [L6309] CALL, EXPR ldv_zalloc(1UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=1, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=1, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=1, tmp___0=1, tx_queue={4146:0}] [L6309] RET, EXPR ldv_zalloc(1UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(1UL)={0:0}, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tx_queue={4146:0}] [L6309] tmp___5 = ldv_zalloc(1UL) [L6310] ldvarg6 = tmp___5 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tx_queue={4146:0}] [L6311] CALL ldv_initialize() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6858] CALL ldv_set_init(LDV_SKBS) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6686] set = set_impl [L6687] last_index = 0 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={4156:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6858] RET ldv_set_init(LDV_SKBS) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6311] RET ldv_initialize() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=0, ldv_state_variable_1=0, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tx_queue={4146:0}] [L6312] ldv_state_variable_1 = 1 [L6313] ref_cnt = 0 [L6314] ldv_state_variable_0 = 1 [L6315] ldv_state_variable_3 = 0 [L6316] ldv_state_variable_2 = 0 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tx_queue={4146:0}] [L6318] tmp___6 = __VERIFIER_nondet_int() [L6320] case 0: [L6327] case 1: VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tx_queue={4146:0}] [L6328] COND TRUE ldv_state_variable_0 != 0 [L6329] tmp___7 = __VERIFIER_nondet_int() [L6331] case 0: [L6340] case 1: VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tx_queue={4146:0}] [L6341] COND TRUE ldv_state_variable_0 == 1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tx_queue={4146:0}] [L6342] CALL, EXPR mod_init() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6183] CALL skb_queue_head_init(& tx_queue) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5191] struct lock_class_key __key ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __key={4167:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5194] CALL spinlock_check(& list->lock) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, lock={4146:20}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5137] return (& lock->ldv_6338.rlock); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={4146:20}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, lock={4146:20}, lock={4146:20}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5194] RET spinlock_check(& list->lock) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __key={4167:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, spinlock_check(& list->lock)={4146:20}, tx_queue={4146:0}] [L5196] CALL __skb_queue_head_init(list) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5179] struct sk_buff *tmp ; [L5182] tmp = (struct sk_buff *)list [L5183] list->next = tmp [L5184] list->prev = tmp [L5185] list->qlen = 0U VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={4146:0}, tx_queue={4146:0}] [L5196] RET __skb_queue_head_init(list) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __key={4167:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5197] return; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, list={4146:0}, list={4146:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6183] RET skb_queue_head_init(& tx_queue) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6185] return (0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6342] RET, EXPR mod_init() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=1, ldv_state_variable_1=1, ldv_state_variable_2=0, ldv_state_variable_3=0, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, mod_init()=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tx_queue={4146:0}] [L6342] ldv_retval_0 = mod_init() [L6343] COND TRUE ldv_retval_0 == 0 [L6344] ldv_state_variable_0 = 3 [L6345] ldv_state_variable_2 = 1 [L6346] ldv_state_variable_3 = 1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tx_queue={4146:0}] [L6347] CALL ldv_initialize_hdlc_proto_3() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6228] void *tmp ; [L6229] void *tmp___0 ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6232] CALL, EXPR ldv_zalloc(3264UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=3264, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=3264, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=3264, tmp___0=1, tx_queue={4146:0}] [L6232] RET, EXPR ldv_zalloc(3264UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(3264UL)={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6232] tmp = ldv_zalloc(3264UL) [L6233] proto_group1 = (struct net_device *)tmp VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tx_queue={4146:0}] [L6234] CALL, EXPR ldv_zalloc(232UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=232, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=232, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=232, tmp___0=1, tx_queue={4146:0}] [L6234] RET, EXPR ldv_zalloc(232UL) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(232UL)={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tx_queue={4146:0}] [L6234] tmp___0 = ldv_zalloc(232UL) [L6235] proto_group0 = (struct sk_buff *)tmp___0 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0={0:0}, tx_queue={4146:0}] [L6347] RET ldv_initialize_hdlc_proto_3() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tx_queue={4146:0}] [L6351] COND FALSE !(ldv_retval_0 != 0) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tx_queue={4146:0}] [L6318] tmp___6 = __VERIFIER_nondet_int() [L6320] case 0: [L6327] case 1: [L6369] case 2: VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tx_queue={4146:0}] [L6370] COND TRUE ldv_state_variable_3 != 0 [L6371] tmp___8 = __VERIFIER_nondet_int() [L6373] case 0: [L6381] case 1: [L6413] case 2: [L6445] case 3: [L6453] case 4: VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6454] COND FALSE !(ldv_state_variable_3 == 4) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6460] COND TRUE ldv_state_variable_3 == 1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6461] CALL ppp_rx(proto_group0) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, tx_queue={4146:0}] [L5865] struct hdlc_header *hdr ; [L5866] struct net_device *dev ; [L5867] struct ppp *ppp ; [L5868] struct ppp *tmp ; [L5869] struct proto *proto___0 ; [L5870] struct cp_header *cp ; [L5871] unsigned long flags ; [L5872] unsigned int len ; [L5873] u16 pid ; [L5874] raw_spinlock_t *tmp___0 ; [L5875] unsigned char *tmp___1 ; [L5876] __u16 tmp___2 ; [L5877] __u16 tmp___3 ; [L5878] __u16 tmp___4 ; [L5881] EXPR skb->data [L5881] hdr = (struct hdlc_header *)skb->data [L5882] EXPR skb->dev [L5882] dev = skb->dev [L5883] CALL, EXPR get_ppp(dev) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5414] struct hdlc_device *tmp ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5417] CALL, EXPR dev_to_hdlc(dev) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5402] void *tmp ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5405] CALL, EXPR netdev_priv((struct net_device const *)dev) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5353] return ((void *)dev + 3264U); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={4113:0}, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5405] RET, EXPR netdev_priv((struct net_device const *)dev) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, netdev_priv((struct net_device const *)dev)={4113:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5405] tmp = netdev_priv((struct net_device const *)dev) [L5406] return ((struct hdlc_device *)tmp); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={4113:0}, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, dev={4113:-3264}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={4113:0}, tx_queue={4146:0}] [L5417] RET, EXPR dev_to_hdlc(dev) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, dev={4113:-3264}, dev_to_hdlc(dev)={4113:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5417] tmp = dev_to_hdlc(dev) [L5418] EXPR tmp->state [L5418] return ((struct ppp *)tmp->state); [L5883] RET, EXPR get_ppp(dev) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, get_ppp(dev)={4174:-435}, hdr={4127:4157}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, tx_queue={4146:0}] [L5883] tmp = get_ppp(dev) [L5884] ppp = tmp VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, hdr={4127:4157}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, tmp={4174:-435}, tx_queue={4146:0}] [L5885] CALL, EXPR spinlock_check(& ppp->lock) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, lock={4174:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5137] return (& lock->ldv_6338.rlock); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={4174:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, lock={4174:0}, lock={4174:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5885] RET, EXPR spinlock_check(& ppp->lock) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, hdr={4127:4157}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, spinlock_check(& ppp->lock)={4174:0}, tmp={4174:-435}, tx_queue={4146:0}] [L5885] tmp___0 = spinlock_check(& ppp->lock) [L5886] flags = _raw_spin_lock_irqsave(tmp___0) [L5887] EXPR skb->len VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, hdr={4127:4157}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, skb->len=0, tmp={4174:-435}, tmp___0={4174:0}, tx_queue={4146:0}] [L5887] COND TRUE skb->len <= 3U [L5994] EXPR dev->stats.rx_errors [L5994] dev->stats.rx_errors = dev->stats.rx_errors + 1UL [L5996] CALL spin_unlock_irqrestore(& ppp->lock, flags) VAL [\old(flags)=4124, \old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, lock={4174:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5996] RET spin_unlock_irqrestore(& ppp->lock, flags) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, flags=4124, hdr={4127:4157}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, tmp={4174:-435}, tmp___0={4174:0}, tx_queue={4146:0}] [L5997] CALL dev_kfree_skb_any(skb) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, tx_queue={4146:0}] [L5997] RET dev_kfree_skb_any(skb) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, flags=4124, hdr={4127:4157}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, tmp={4174:-435}, tmp___0={4174:0}, tx_queue={4146:0}] [L5998] CALL ppp_tx_flush() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5519] struct sk_buff *skb ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5526] CALL, EXPR ldv_skb_dequeue_12(& tx_queue) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6625] struct sk_buff *tmp ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, ldv_func_arg1={4146:0}, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6628] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6839] void *skb ; [L6840] void *tmp___7 ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6843] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=248, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND FALSE !(tmp___0 != 0) [L5264] EXPR, FCALL calloc(1UL, size) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=248, __this_module={4178:4142}, calloc(1UL, size)={1:0}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=248, tmp___0=0, tx_queue={4146:0}] [L5264] tmp = calloc(1UL, size) [L5265] p = tmp [L5267] return (p); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=248, \result={1:0}, __this_module={4178:4142}, calloc(1UL, size)={1:0}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, p={1:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=248, tmp={1:0}, tmp___0=0, tx_queue={4146:0}] [L6843] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={1:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6843] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6844] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={1:0}, tmp___7={1:0}, tx_queue={4146:0}] [L6845] COND FALSE !(! skb) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={1:0}, tmp___7={1:0}, tx_queue={4146:0}] [L6848] CALL ldv_set_add(LDV_SKBS, skb) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, e={1:0}, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6694] int i ; [L6697] i = 0 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, e={1:0}, e={1:0}, i=0, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6698] COND TRUE 1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, e={1:0}, e={1:0}, i=0, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6699] COND FALSE !(i < last_index) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, e={1:0}, e={1:0}, i=0, last_index=0, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6711] COND TRUE last_index < 15 [L6712] set_impl[last_index] = e [L6713] last_index = last_index + 1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, e={1:0}, e={1:0}, i=0, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6848] RET ldv_set_add(LDV_SKBS, skb) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={1:0}, tmp___7={1:0}, tx_queue={4146:0}] [L6849] return (skb); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={1:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={1:0}, tmp___7={1:0}, tx_queue={4146:0}] [L6628] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, ldv_func_arg1={4146:0}, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, ldv_skb_alloc()={1:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6628] tmp = ldv_skb_alloc() [L6629] return (tmp); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={1:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, ldv_func_arg1={4146:0}, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={1:0}, tx_queue={4146:0}] [L5526] RET, EXPR ldv_skb_dequeue_12(& tx_queue) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, ldv_skb_dequeue_12(& tx_queue)={1:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5526] skb = ldv_skb_dequeue_12(& tx_queue) [L5527] COND TRUE (unsigned long )skb != (unsigned long )((struct sk_buff *)0) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={1:0}, tx_queue={4146:0}] [L5526] CALL, EXPR ldv_skb_dequeue_12(& tx_queue) VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6625] struct sk_buff *tmp ; VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, ldv_func_arg1={4146:0}, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6628] CALL, EXPR ldv_skb_alloc() VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6839] void *skb ; [L6840] void *tmp___7 ; VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6843] CALL, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=248, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5255] void *p ; [L5256] void *tmp ; [L5257] int tmp___0 ; [L5260] tmp___0 = __VERIFIER_nondet_int() [L5261] COND TRUE tmp___0 != 0 [L5262] return ((void *)0); VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \old(size)=248, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, size=248, tmp___0=1, tx_queue={4146:0}] [L6843] RET, EXPR ldv_zalloc(sizeof(struct sk_buff___0 )) VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldv_zalloc(sizeof(struct sk_buff___0 ))={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6843] tmp___7 = ldv_zalloc(sizeof(struct sk_buff___0 )) [L6844] skb = (struct sk_buff___0 *)tmp___7 VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, tmp___7={0:0}, tx_queue={4146:0}] [L6845] COND TRUE ! skb [L6846] return ((void *)0); VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, tmp___7={0:0}, tx_queue={4146:0}] [L6628] RET, EXPR ldv_skb_alloc() VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, ldv_func_arg1={4146:0}, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, ldv_skb_alloc()={0:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6628] tmp = ldv_skb_alloc() [L6629] return (tmp); VAL [\old(last_index)=1, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result={0:0}, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, ldv_func_arg1={4146:0}, ldv_func_arg1={4146:0}, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tx_queue={4146:0}] [L5526] RET, EXPR ldv_skb_dequeue_12(& tx_queue) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, ldv_skb_dequeue_12(& tx_queue)={0:0}, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={1:0}, tx_queue={4146:0}] [L5526] skb = ldv_skb_dequeue_12(& tx_queue) [L5527] COND FALSE !((unsigned long )skb != (unsigned long )((struct sk_buff *)0)) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, tx_queue={4146:0}] [L5998] RET ppp_tx_flush() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, flags=4124, hdr={4127:4157}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, tmp={4174:-435}, tmp___0={4174:0}, tx_queue={4146:0}] [L5999] return (1); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result=1, __this_module={4178:4142}, cp_table={4119:0}, dev={4113:-3264}, flags=4124, hdr={4127:4157}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp={4174:-435}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, skb={0:0}, skb={0:0}, tmp={4174:-435}, tmp___0={4174:0}, tx_queue={4146:0}] [L6461] RET ppp_rx(proto_group0) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, ppp_rx(proto_group0)=1, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6462] ldv_state_variable_3 = 1 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6466] COND FALSE !(ldv_state_variable_3 == 3) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6472] COND FALSE !(ldv_state_variable_3 == 2) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6478] COND FALSE !(ldv_state_variable_3 == 5) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=2, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6318] tmp___6 = __VERIFIER_nondet_int() [L6320] case 0: [L6327] case 1: VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=1, tmp___8=4, tx_queue={4146:0}] [L6328] COND TRUE ldv_state_variable_0 != 0 [L6329] tmp___7 = __VERIFIER_nondet_int() [L6331] case 0: VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0, tmp___8=4, tx_queue={4146:0}] [L6332] COND TRUE ldv_state_variable_0 == 3 && ref_cnt == 0 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0, tmp___8=4, tx_queue={4146:0}] [L6333] CALL mod_exit() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6333] RET mod_exit() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=3, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0, tmp___8=4, tx_queue={4146:0}] [L6334] ldv_state_variable_0 = 2 VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ldvarg0={0:0}, ldvarg1=4110, ldvarg2={0:0}, ldvarg3={0:0}, ldvarg4=4173, ldvarg5={0:0}, ldvarg6={0:0}, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp={0:0}, tmp___0=4110, tmp___1=4173, tmp___2={0:0}, tmp___3={0:0}, tmp___4={0:0}, tmp___5={0:0}, tmp___6=1, tmp___7=0, tmp___8=4, tx_queue={4146:0}] [L6574] CALL ldv_check_final_state() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6916] int tmp___7 ; VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6919] CALL, EXPR ldv_set_is_empty(LDV_SKBS) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6790] return (last_index == 0); VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, \result=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set={0:0}, set={0:0}, set_impl={4156:0}, tx_queue={4146:0}] [L6919] RET, EXPR ldv_set_is_empty(LDV_SKBS) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, ldv_set_is_empty(LDV_SKBS)=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L6919] tmp___7 = ldv_set_is_empty(LDV_SKBS) [L6920] COND FALSE !(\read(tmp___7)) VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tmp___7=0, tx_queue={4146:0}] [L6923] CALL ldv_error() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] [L5304] __VERIFIER_error() VAL [\old(last_index)=0, \old(LDV_IN_INTERRUPT)=1, \old(ldv_retval_0)=0, \old(ldv_state_variable_0)=0, \old(ldv_state_variable_1)=0, \old(ldv_state_variable_2)=0, \old(ldv_state_variable_3)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_list_1)=0, \old(ldv_timer_state_1)=0, \old(proto_group0)=0, \old(proto_group0)=0, \old(proto_group1)=0, \old(proto_group1)=0, \old(ref_cnt)=0, __this_module={4178:4142}, cp_table={4119:0}, last_index=1, LDV_IN_INTERRUPT=1, ldv_retval_0=0, LDV_SKBS={0:0}, ldv_state_variable_0=2, ldv_state_variable_1=1, ldv_state_variable_2=1, ldv_state_variable_3=1, ldv_timer_list_1={0:0}, ldv_timer_state_1=0, ppp_header_ops={4133:0}, proto={4139:0}, proto_group0={0:0}, proto_group1={0:0}, ref_cnt=0, set_impl={4156:0}, tx_queue={4146:0}] - StatisticsResult: Ultimate Automizer benchmark data CFG has 61 procedures, 636 locations, 1 error locations. UNSAFE Result, 21.0s OverallTime, 10 OverallIterations, 9 TraceHistogramMax, 3.2s AutomataDifference, 0.0s DeadEndRemovalTime, 0.0s HoareAnnotationTime, HoareTripleCheckerStatistics: 9654 SDtfs, 5654 SDslu, 23229 SDs, 0 SdLazy, 1469 SolverSat, 304 SolverUnsat, 0 SolverUnknown, 0 SolverNotchecked, 1.5s Time, PredicateUnifierStatistics: 0 DeclaredPredicates, 161 GetRequests, 125 SyntacticMatches, 1 SemanticMatches, 35 ConstructedPredicates, 0 IntricatePredicates, 0 DeprecatedPredicates, 17 ImplicationChecksByTransitivity, 0.6s Time, 0.0s BasicInterpolantAutomatonTime, BiggestAbstraction: size=4556occurred in iteration=9, traceCheckStatistics: No data available, InterpolantConsolidationStatistics: No data available, PathInvariantsStatistics: No data available, 0/0 InterpolantCoveringCapability, TotalInterpolationStatistics: No data available, 0.0s AbstIntTime, 0 AbstIntIterations, 0 AbstIntStrong, NaN AbsIntWeakeningRatio, NaN AbsIntAvgWeakeningVarsNumRemoved, NaN AbsIntAvgWeakenedConjuncts, 0.0s DumpTime, AutomataMinimizationStatistics: 1.0s AutomataMinimizationTime, 9 MinimizatonAttempts, 182 StatesRemovedByMinimization, 5 NontrivialMinimizations, HoareAnnotationStatistics: No data available, RefinementEngineStatistics: TraceCheckStatistics: 0.0s SsaConstructionTime, 0.4s SatisfiabilityAnalysisTime, 1.0s InterpolantComputationTime, 1695 NumberOfCodeBlocks, 1695 NumberOfCodeBlocksAsserted, 11 NumberOfCheckSat, 1471 ConstructedInterpolants, 0 QuantifiedInterpolants, 324151 SizeOfPredicates, 2 NumberOfNonLiveVariables, 1240 ConjunctsInSsa, 10 ConjunctsInUnsatCore, 10 InterpolantComputations, 9 PerfectInterpolantSequences, 1066/1071 InterpolantCoveringCapability, InvariantSynthesisStatistics: No data available, InterpolantConsolidationStatistics: No data available, ReuseStatistics: No data available RESULT: Ultimate proved your program to be incorrect! Received shutdown request...