This is still missing a mode to rewrite $overwrite_tag and $original_tag by injecting $set_tag and $get_tag in the right places. It's also missing bit-precise propagation models for shifts and arithmetic and requires the design to be flattened.