pose_title=Path-optimal symbolic execution of heap-manipulating programs
pose_authors=Pietro Braione; Giovanni Denaro; Luca Guglielmo
pose_arxiv_id=2407.16827v2
pose_arxiv_url=https://arxiv.org/abs/2407.16827
pose_pdf_sha256=5a4137d0b06ad021ef08c653ee43339d158b44d197093f7766f626aa4ca3c9a7
pose_artifact_repository=https://github.com/pietrobraione/jpose
pose_artifact_head=427c19bbbce12021fda958e7d88650be2417920e
pose_principle=retain heap alias and distinctness relationships in conditional expressions and fork at actual program decisions
llvm_langref_title=LLVM Language Reference Manual
llvm_langref_url=https://llvm.org/docs/LangRef.html
llvm_langref_local_versions=17.0.6;18.1.3
llvm_langref_fact=SSA definitions dominate uses; load/store operate through pointer-associated address ranges
llvm_memoryssa_title=LLVM MemorySSA
llvm_memoryssa_url=https://llvm.org/docs/MemorySSA.html
llvm_memoryssa_fact=intraprocedural MemoryDef/MemoryUse/MemoryPhi representation; F406 does not claim a complete MemorySSA walker
symmmu_title=symMMU: Symbolic Memory Management Unit
symmmu_url=https://doi.org/10.1145/2642937.2642974
memsight_title=Rethinking Pointer Reasoning in Symbolic Execution
memsight_url=https://season-lab.github.io/papers/memsight-ase17.pdf
segmented_memory_url=https://srg.doc.ic.ac.uk/projects/klee-segmem/
adaptation=F406 corrects the single-store quantifier to a finite set of dominating stores over already allocated bounded C heap objects
producer_boundary=the consumer verifies canonical bases and exact alias-owner equality but does not independently replay LLVM dominance from the artifact
runtime_boundary=the certificate admits lowering only; runtime live and byte-initialization markers remain authoritative
not_equivalent=No initial symbolic heap, fresh-object materialization, path-correlated branch-local stores, dynamic-index proof, interprocedural MemorySSA, or full POSE reproduction
evidence_boundary=Local finite-domain semantics and reference-proof cost only; no public-target coverage, solver-throughput, bug-yield, or end-to-end speedup claim