An indirect call can have the right target and still be wrong to follow.
That drove a lot of our work on PRISM, proving stack writes, return paths, and machine state in Hyper-V, and checking those proofs again after rewriting.
blog.probe.ac/posts/indirect…
