spec: EBX_post = EBX_pre
; must stay unchanged
impl: EBX_post = (op1 == EBX_pre) ? 1 : 0
; the bug
op1
EBX_pre
spec says EBX_post
—
impl gives EBX_post
—
Let the solver pick a counterexample
Find the safe input