Unproven file_set_attr. Maybe exclude updating the length attribute?  Now the spec isn't quite right, and probably unprovable without some extra promises from the caller. Other option is to add an extra precondition that states new length is equal to old length, which is true for our one use case.
Unproven file_set_attr. Maybe exclude updating the length attribute?  Now the spec
isn't quite right, and probably unprovable without some extra promises from the caller.
Other option is to add an extra precondition that states new length is equal to old length,
which is true for our one use case.

mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl,mit-pdos/fscq-impl