| dirs1 = dirs, err = ESUCCESS, dom of < ino, afs-cons(dirs, files), of-cons(of, dirs, files), fd ∈ of, n ≤ # buf, of[fd].mode ≠ MODE_W → fd ∈ of ⊦ [err := EBADFD] (dirs1 = dirs → of-cons(of, dirs, files) ∧ dom of < ino ∧ afs-cons(dirs, files)), of[fd].mode = MODE_RW, of[fd].mode = MODE_W |