| # lpt = # avol, m = m2, m1 = m3, rofs, ebm-vol-inv(avol), wbuf-cons(bleb, wbuf, avol, rofs), ¬ rofs → bleb = buffered(m3) ∨ (bleb = nobuffer ∨ wbuf.nbytes = 0) ∧ m3 < # avol ∧ avol[m3].mapped? ∧ m0 = # avol[m3].data ⊦ ⟪err := EROFS⟫ wbuf-cons(bleb, wbuf, avol, rofs) |