Used simplifier rules: in: ⊦ adr ∈ st ↔ adr.lnum ∈ st ∧ @(adr.pos, adr.size) ∈ st[adr.lnum].ladrlist;% ⊦ @(m, m0, m1).lnum = m; (s)