| # buf = (n2 + n1) * LEB_SIZE, avol[n3 + n1] = mapped(buf0), err = err0, n = LEB_SIZE, n0 = n1 * LEB_SIZE, subarray(buf, 0, n1 * LEB_SIZE) = lebs(avol, n3, n1), n3 + n1 < # avol, ebm-vol-inv(avol), mapped-full?(avol, n3, n2 + n1), n3 + n2 + n1 ≤ # avol, n1 * LEB_SIZE + LEB_SIZE ≤ # buf, ⌊err0⌋ ∨ err0 = ESUCCESS ⊦ err = ESUCCESS, n2 = 0, ∀ buf1. # buf1 = # buf → range=(buf, 0, buf1, 0, n0) → # buf ≥ n0 + n |
Used simplifier rules: # buf = n ⊦ subarray(buf, 0, n) = buf; (s)% ⊦ m ≤ n → (n < m ↔ false); (s)% ⊦ m ≤ n ↔ ¬ n < m; (ss)% ⊦ n ≥ m ↔ m ≤ n; (s)