The model checking would not check the output but the trace of operations. It might prove that all bytes of the output were written to at least once, that dere

The model checking would not check the output but the trace of operations. It might prove that all bytes of the output were written to at least once, that dereferenced pointers point toward either the input or some other valid structure, and other properties like this.