diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f38b3bd2c328..72ef4e2de889 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,6 +16,7 @@ on:
 
 env:
   RUST_BACKTRACE: 1
+  ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
 
 jobs:
   build_bundle_macos:
@@ -326,7 +327,7 @@ jobs:
     if: ${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/kani-') }}
     name: Release
     runs-on: ubuntu-20.04
-    needs: [build_bundle_macos, build_bundle_linux, test_bundle, test_alt_platform]
+    needs: [build_bundle_macos, build_bundle_macos_aarch64, build_bundle_linux, test_bundle, test_alt_platform]
     permissions:
       contents: write
     outputs:
@@ -358,6 +359,11 @@ jobs:
         with:
           name: ${{ needs.build_bundle_macos.outputs.bundle }}
 
+      - name: Download MacOS ARM bundle
+        uses: actions/download-artifact@v3
+        with:
+          name: ${{ needs.build_bundle_macos_aarch64.outputs.bundle }}
+
       - name: Download Linux bundle
         uses: actions/download-artifact@v3
         with:
@@ -371,7 +377,7 @@ jobs:
         with:
           name: kani-${{ env.TAG_VERSION }}
           tag: kani-${{ env.TAG_VERSION }}
-          artifacts: "${{ needs.build_bundle_linux.outputs.bundle }},${{ needs.build_bundle_macos.outputs.bundle }}"
+          artifacts: "${{ needs.build_bundle_linux.outputs.bundle }},${{ needs.build_bundle_macos.outputs.bundle }},${{ needs.build_bundle_macos_aarch64.outputs.bundle }}"
           body: |
             Kani Rust verifier release bundle version ${{ env.TAG_VERSION }}.
           draft: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9b4acbb284aa..47ae290853a3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,44 @@ This file contains notable changes (e.g. breaking changes, major changes, etc.)
 
 This file was introduced starting Kani 0.23.0, so it only contains changes from version 0.23.0 onwards.
 
+## [0.53.0]
+
+### Major Changes
+* The `--visualize` option is being deprecated and will be removed in a future release. Consider using the `--concrete-playback` option instead.
+* The `-Z ptr-to-ref-cast-checks` option is being introduced to check pointer validity when casting raw pointers to references. The feature is currently behind an unstable flag but is expected to be stabilized in a future release once remaining performance issues have been resolved.
+* The `-Z uninit-checks` option is being introduced to check memory initialization. The feature is currently behind an unstable flag and also requires the `-Z ghost-state` option.
+
+### Breaking Changes
+* Remove support for the unstable argument `--function` by @celinval in https://github.com/model-checking/kani/pull/3278
+* Remove deprecated `--enable-stubbing` by @celinval in https://github.com/model-checking/kani/pull/3309
+
+### What's Changed
+
+* Change ensures into closures by @pi314mm in https://github.com/model-checking/kani/pull/3207
+* (Re)introduce `Invariant` trait by @adpaco-aws in https://github.com/model-checking/kani/pull/3190
+* Remove empty box creation from contracts impl by @celinval in https://github.com/model-checking/kani/pull/3233
+* Add a new verify-std subcommand to Kani by @celinval in https://github.com/model-checking/kani/pull/3231
+* Inject pointer validity check when casting raw pointers to references by @artemagvanian in https://github.com/model-checking/kani/pull/3221
+* Do not turn trivially diverging loops into assume(false) by @tautschnig in https://github.com/model-checking/kani/pull/3223
+* Fix "unused mut" warnings created by generated code. by @jsalzbergedu in https://github.com/model-checking/kani/pull/3247
+* Refactor stubbing so Kani compiler only invoke rustc once per crate by @celinval in https://github.com/model-checking/kani/pull/3245
+* Use cfg=kani_host for host crates by @tautschnig in https://github.com/model-checking/kani/pull/3244
+* Add intrinsics and Arbitrary support for no_core by @jaisnan in https://github.com/model-checking/kani/pull/3230
+* Contracts: Avoid attribute duplication and `const` function generation for constant function by @celinval in https://github.com/model-checking/kani/pull/3255
+* Fix contract of constant fn with effect feature by @celinval in https://github.com/model-checking/kani/pull/3259
+* Fix typed_swap for ZSTs by @tautschnig in https://github.com/model-checking/kani/pull/3256
+* Add a `#[derive(Invariant)]` macro by @adpaco-aws in https://github.com/model-checking/kani/pull/3250
+* Contracts: History Expressions via "old" monad by @pi314mm in https://github.com/model-checking/kani/pull/3232
+* Function Contracts: remove instances of _renamed by @pi314mm in https://github.com/model-checking/kani/pull/3274
+* Deprecate `--visualize` in favor of concrete playback by @celinval in https://github.com/model-checking/kani/pull/3281
+* Fix operand in fat pointer comparison by @pi314mm in https://github.com/model-checking/kani/pull/3297
+* Function Contracts: Closure Type Inference by @pi314mm in https://github.com/model-checking/kani/pull/3307
+* Add support for f16 and f128 for toolchain upgrade to 6/28 by @jaisnan in https://github.com/model-checking/kani/pull/3306
+* Towards Proving Memory Initialization by @artemagvanian in https://github.com/model-checking/kani/pull/3264
+* Rust toolchain upgraded to `nightly-2024-07-01` by @tautschnig @celinval @jaisnan @adpaco-aws
+
+**Full Changelog**: https://github.com/model-checking/kani/compare/kani-0.52.0...kani-0.53.0
+
 ## [0.52.0]
 
 ## What's Changed
diff --git a/Cargo.lock b/Cargo.lock
index c7a451cc8804..0fd31f73278b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -86,13 +86,13 @@ checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
 [[package]]
 name = "bitflags"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
+checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
 
 [[package]]
 name = "build-kani"
-version = "0.52.0"
+version = "0.53.0"
 dependencies = [
  "anyhow",
  "cargo_metadata",
@@ -140,9 +140,9 @@ checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
 [[package]]
 name = "clap"
-version = "4.5.7"
+version = "4.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5db83dced34638ad474f39f250d7fea9598bdd239eaced1bdf45d597da0f433f"
+checksum = "64acc1846d54c1fe936a78dc189c34e28d3f5afc348403f28ecf53660b9b8462"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -150,9 +150,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.7"
+version = "4.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7e204572485eb3fbf28f871612191521df159bc3e15a9f5064c66dba3a8c05f"
+checksum = "6fb8393d67ba2e7bfaf28a23458e4e2b543cc73a99595511eb207fdb8aede942"
 dependencies = [
  "anstream",
  "anstyle",
@@ -162,14 +162,14 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.5"
+version = "4.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c780290ccf4fb26629baa7a1081e68ced113f1d3ec302fa5948f1c381ebf06c6"
+checksum = "2bac35c6dafb060fd4d275d9a4ffae97917c13a6327903a8be2153cd964f7085"
 dependencies = [
  "heck",
  "proc-macro2",
  "quote",
- "syn 2.0.68",
+ "syn 2.0.72",
 ]
 
 [[package]]
@@ -228,7 +228,7 @@ dependencies = [
 
 [[package]]
 name = "cprover_bindings"
-version = "0.52.0"
+version = "0.53.0"
 dependencies = [
  "lazy_static",
  "linear-map",
@@ -290,9 +290,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.12.0"
+version = "1.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3dca9240753cf90908d7e4aac30f630662b02aebaa1b58a3cadabdb23385b58b"
+checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
 
 [[package]]
 name = "encode_unicode"
@@ -405,14 +405,14 @@ checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
 
 [[package]]
 name = "kani"
-version = "0.52.0"
+version = "0.53.0"
 dependencies = [
  "kani_macros",
 ]
 
 [[package]]
 name = "kani-compiler"
-version = "0.52.0"
+version = "0.53.0"
 dependencies = [
  "clap",
  "cprover_bindings",
@@ -433,7 +433,7 @@ dependencies = [
 
 [[package]]
 name = "kani-driver"
-version = "0.52.0"
+version = "0.53.0"
 dependencies = [
  "anyhow",
  "cargo_metadata",
@@ -461,7 +461,7 @@ dependencies = [
 
 [[package]]
 name = "kani-verifier"
-version = "0.52.0"
+version = "0.53.0"
 dependencies = [
  "anyhow",
  "home",
@@ -470,24 +470,24 @@ dependencies = [
 
 [[package]]
 name = "kani_core"
-version = "0.52.0"
+version = "0.53.0"
 dependencies = [
  "kani_macros",
 ]
 
 [[package]]
 name = "kani_macros"
-version = "0.52.0"
+version = "0.53.0"
 dependencies = [
  "proc-macro-error",
  "proc-macro2",
  "quote",
- "syn 2.0.68",
+ "syn 2.0.72",
 ]
 
 [[package]]
 name = "kani_metadata"
-version = "0.52.0"
+version = "0.53.0"
 dependencies = [
  "clap",
  "cprover_bindings",
@@ -536,9 +536,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.21"
+version = "0.4.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
+checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
 
 [[package]]
 name = "matchers"
@@ -587,9 +587,9 @@ dependencies = [
 
 [[package]]
 name = "num-bigint"
-version = "0.4.5"
+version = "0.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c165a9ab64cf766f73521c0dd2cfdff64f488b8f0b3e621face3462d3db536d7"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
 dependencies = [
  "num-integer",
  "num-traits",
@@ -801,9 +801,9 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.2"
+version = "0.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c82cf8cff14456045f55ec4241383baeff27af886adb72ffb2162f99911de0fd"
+checksum = "2a908a6e00f1fdd0dfd9c0eb08ce85126f6d8bbda50017e74bc4a4b7d4a926a4"
 dependencies = [
  "bitflags",
 ]
@@ -909,29 +909,29 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.203"
+version = "1.0.204"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7253ab4de971e72fb7be983802300c30b5a7f0c2e56fab8abfc6a214307c0094"
+checksum = "bc76f558e0cbb2a839d37354c575f1dc3fdc6546b5be373ba43d95f231bf7c12"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.203"
+version = "1.0.204"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "500cbc0ebeb6f46627f50f3f5811ccf6bf00643be300b4c3eabc0ef55dc5b5ba"
+checksum = "e0cd7e117be63d3c3678776753929474f3b04a43a080c744d6b0ae2a8c28e222"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.68",
+ "syn 2.0.72",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.117"
+version = "1.0.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "455182ea6142b14f93f4bc5320a2b31c1f266b66a4a5c858b013302a5d8cbfc3"
+checksum = "4e0d21c9a8cae1235ad58a00c11cb40d4b1e5c784f1ef2c537876ed6ffd8b7c5"
 dependencies = [
  "itoa",
  "ryu",
@@ -992,7 +992,7 @@ checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
 
 [[package]]
 name = "std"
-version = "0.52.0"
+version = "0.53.0"
 dependencies = [
  "kani",
 ]
@@ -1030,7 +1030,7 @@ dependencies = [
  "proc-macro2",
  "quote",
  "rustversion",
- "syn 2.0.68",
+ "syn 2.0.72",
 ]
 
 [[package]]
@@ -1045,9 +1045,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.68"
+version = "2.0.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "901fa70d88b9d6c98022e23b4136f9f3e54e4662c3bc1bd1d84a42a9a0f0c1e9"
+checksum = "dc4b9b9bf2add8093d3f2c0204471e951b2285580335de42f9d2534f3ae7a8af"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1068,22 +1068,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "1.0.61"
+version = "1.0.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709"
+checksum = "c0342370b38b6a11b6cc11d6a805569958d54cfa061a29969c3b5ce2ea405724"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "1.0.61"
+version = "1.0.63"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46c3384250002a6d5af4d114f2845d37b57521033f30d5c3f46c4d70e1197533"
+checksum = "a4558b58466b9ad7ca0f102865eccc95938dca1a74a856f2b57b6629050da261"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.68",
+ "syn 2.0.72",
 ]
 
 [[package]]
@@ -1098,9 +1098,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.8.14"
+version = "0.8.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f49eb2ab21d2f26bd6db7bf383edc527a7ebaee412d17af4d40fdccd442f335"
+checksum = "ac2caab0bf757388c6c0ae23b3293fdb463fee59434529014f85e3263b995c28"
 dependencies = [
  "serde",
  "serde_spanned",
@@ -1119,9 +1119,9 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.22.14"
+version = "0.22.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f21c7aaf97f1bd9ca9d4f9e73b0a6c74bd5afef56f2bc931943a6e1c37e04e38"
+checksum = "278f3d518e152219c994ce877758516bca5e118eaed6996192a774fb9fbf0788"
 dependencies = [
  "indexmap",
  "serde",
@@ -1149,7 +1149,7 @@ checksum = "34704c8d6ebcbc939824180af020566b01a7c01f80641264eba0999f6c2b6be7"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.68",
+ "syn 2.0.72",
 ]
 
 [[package]]
@@ -1320,9 +1320,9 @@ dependencies = [
 
 [[package]]
 name = "windows-targets"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
  "windows_aarch64_gnullvm",
  "windows_aarch64_msvc",
@@ -1336,57 +1336,57 @@ dependencies = [
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
 [[package]]
 name = "windows_i686_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
-version = "0.6.13"
+version = "0.6.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59b5e5f6c299a3c7890b876a2a587f3115162487e704907d9b6cd29473052ba1"
+checksum = "374ec40a2d767a3c1b4972d9475ecd557356637be906f2cb3f7fe17a6eb5e22f"
 dependencies = [
  "memchr",
 ]
@@ -1399,20 +1399,20 @@ checksum = "d135d17ab770252ad95e9a872d365cf3090e3be864a34ab46f48555993efc904"
 
 [[package]]
 name = "zerocopy"
-version = "0.7.34"
+version = "0.7.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae87e3fcd617500e5d106f0380cf7b77f3c6092aae37191433159dda23cfb087"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.7.34"
+version = "0.7.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15e934569e47891f7d9411f1a451d947a60e000ab3bd24fbb970f000387d1b3b"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.68",
+ "syn 2.0.72",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 641cbaf961be..1b4933c5bdcf 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@
 
 [package]
 name = "kani-verifier"
-version = "0.52.0"
+version = "0.53.0"
 edition = "2021"
 description = "A bit-precise model checker for Rust."
 readme = "README.md"
diff --git a/cprover_bindings/Cargo.toml b/cprover_bindings/Cargo.toml
index 63dfbf6781cd..aced9e5b9b65 100644
--- a/cprover_bindings/Cargo.toml
+++ b/cprover_bindings/Cargo.toml
@@ -3,7 +3,7 @@
 
 [package]
 name = "cprover_bindings"
-version = "0.52.0"
+version = "0.53.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 publish = false
diff --git a/cprover_bindings/src/goto_program/expr.rs b/cprover_bindings/src/goto_program/expr.rs
index 75eb18df0abb..16f33115e0ff 100644
--- a/cprover_bindings/src/goto_program/expr.rs
+++ b/cprover_bindings/src/goto_program/expr.rs
@@ -98,7 +98,11 @@ pub enum ExprValue {
     // {}
     EmptyUnion,
     /// `1.0f`
+    Float16Constant(f16),
+    /// `1.0f`
     FloatConstant(f32),
+    /// `Float 128 example`
+    Float128Constant(f128),
     /// `function(arguments)`
     FunctionCall {
         function: Expr,
@@ -581,6 +585,28 @@ impl Expr {
         expr!(EmptyUnion, typ)
     }
 
+    /// `3.14f`
+    pub fn float16_constant(c: f16) -> Self {
+        expr!(Float16Constant(c), Type::float16())
+    }
+
+    /// `union {_Float16 f; uint16_t bp} u = {.bp = 0x1234}; >>> u.f <<<`
+    pub fn float16_constant_from_bitpattern(bp: u16) -> Self {
+        let c = f16::from_bits(bp);
+        Self::float16_constant(c)
+    }
+
+    /// `3.14159265358979323846264338327950288L`
+    pub fn float128_constant(c: f128) -> Self {
+        expr!(Float128Constant(c), Type::float128())
+    }
+
+    /// `union {_Float128 f; __uint128_t bp} u = {.bp = 0x1234}; >>> u.f <<<`
+    pub fn float128_constant_from_bitpattern(bp: u128) -> Self {
+        let c = f128::from_bits(bp);
+        Self::float128_constant(c)
+    }
+
     /// `1.0f`
     pub fn float_constant(c: f32) -> Self {
         expr!(FloatConstant(c), Type::float())
diff --git a/cprover_bindings/src/goto_program/location.rs b/cprover_bindings/src/goto_program/location.rs
index 4097d075276d..9a2a046f6387 100644
--- a/cprover_bindings/src/goto_program/location.rs
+++ b/cprover_bindings/src/goto_program/location.rs
@@ -19,6 +19,7 @@ pub enum Location {
         start_col: Option<u64>,
         end_line: u64,
         end_col: Option<u64>,
+        pragmas: &'static [&'static str], // CBMC `#pragma check` statements per location.
     },
     /// Location for Statements that use Property Class and Description - Assert, Assume, Cover etc.
     Property {
@@ -28,6 +29,7 @@ pub enum Location {
         col: Option<u64>,
         comment: InternedString,
         property_class: InternedString,
+        pragmas: &'static [&'static str], // CBMC `#pragma check` statements per location.
     },
     /// Covers cases where Location Details are unknown or set as None but Property Class is needed.
     PropertyUnknownLocation { comment: InternedString, property_class: InternedString },
@@ -99,6 +101,7 @@ impl Location {
         start_col: Option<T>,
         end_line: T,
         end_col: Option<T>,
+        pragmas: &'static [&'static str],
     ) -> Location
     where
         T: TryInto<u64>,
@@ -117,6 +120,7 @@ impl Location {
             start_col: start_col_into,
             end_line: end_line_into,
             end_col: end_col_into,
+            pragmas,
         }
     }
 
@@ -128,6 +132,7 @@ impl Location {
         col: Option<T>,
         comment: U,
         property_name: U,
+        pragmas: &'static [&'static str],
     ) -> Location
     where
         T: TryInto<u64>,
@@ -140,7 +145,7 @@ impl Location {
         let function = function.intern();
         let property_class = property_name.into();
         let comment = comment.into();
-        Location::Property { file, function, line, col, comment, property_class }
+        Location::Property { file, function, line, col, comment, property_class, pragmas }
     }
 
     /// Create a Property type Location from an already existing Location type
@@ -157,17 +162,25 @@ impl Location {
                 None,
                 comment.into(),
                 property_name.into(),
+                &[],
+            ),
+            Location::Loc {
+                file,
+                function,
+                start_line,
+                start_col,
+                end_line: _,
+                end_col: _,
+                pragmas,
+            } => Location::property_location(
+                file.into(),
+                function.intern(),
+                start_line,
+                start_col,
+                comment.into(),
+                property_name.into(),
+                pragmas,
             ),
-            Location::Loc { file, function, start_line, start_col, end_line: _, end_col: _ } => {
-                Location::property_location(
-                    file.into(),
-                    function.intern(),
-                    start_line,
-                    start_col,
-                    comment.into(),
-                    property_name.into(),
-                )
-            }
             Location::Property { .. } => location,
             Location::PropertyUnknownLocation { .. } => location,
             // This converts None type Locations to PropertyUnknownLocation type which inserts Property Class and Description
diff --git a/cprover_bindings/src/goto_program/typ.rs b/cprover_bindings/src/goto_program/typ.rs
index da943b26ab19..d0cc8821a447 100644
--- a/cprover_bindings/src/goto_program/typ.rs
+++ b/cprover_bindings/src/goto_program/typ.rs
@@ -41,6 +41,10 @@ pub enum Type {
     FlexibleArray { typ: Box<Type> },
     /// `float`
     Float,
+    /// `_Float16`
+    Float16,
+    /// `_Float128`
+    Float128,
     /// `struct x {}`
     IncompleteStruct { tag: InternedString },
     /// `union x {}`
@@ -166,6 +170,8 @@ impl DatatypeComponent {
             | Double
             | FlexibleArray { .. }
             | Float
+            | Float16
+            | Float128
             | Integer
             | Pointer { .. }
             | Signedbv { .. }
@@ -363,6 +369,8 @@ impl Type {
             Double => st.machine_model().double_width,
             Empty => 0,
             FlexibleArray { .. } => 0,
+            Float16 => 16,
+            Float128 => 128,
             Float => st.machine_model().float_width,
             IncompleteStruct { .. } => unreachable!("IncompleteStruct doesn't have a sizeof"),
             IncompleteUnion { .. } => unreachable!("IncompleteUnion doesn't have a sizeof"),
@@ -532,6 +540,22 @@ impl Type {
         }
     }
 
+    pub fn is_float_16(&self) -> bool {
+        let concrete = self.unwrap_typedef();
+        match concrete {
+            Float16 => true,
+            _ => false,
+        }
+    }
+
+    pub fn is_float_128(&self) -> bool {
+        let concrete = self.unwrap_typedef();
+        match concrete {
+            Float128 => true,
+            _ => false,
+        }
+    }
+
     pub fn is_float(&self) -> bool {
         let concrete = self.unwrap_typedef();
         match concrete {
@@ -543,7 +567,7 @@ impl Type {
     pub fn is_floating_point(&self) -> bool {
         let concrete = self.unwrap_typedef();
         match concrete {
-            Double | Float => true,
+            Double | Float | Float16 | Float128 => true,
             _ => false,
         }
     }
@@ -577,6 +601,8 @@ impl Type {
             | CInteger(_)
             | Double
             | Float
+            | Float16
+            | Float128
             | Integer
             | Pointer { .. }
             | Signedbv { .. }
@@ -632,6 +658,8 @@ impl Type {
             | Double
             | Empty
             | Float
+            | Float16
+            | Float128
             | Integer
             | Pointer { .. }
             | Signedbv { .. }
@@ -918,6 +946,8 @@ impl Type {
             | CInteger(_)
             | Double
             | Float
+            | Float16
+            | Float128
             | Integer
             | Pointer { .. }
             | Signedbv { .. }
@@ -1042,6 +1072,14 @@ impl Type {
         FlexibleArray { typ: Box::new(self) }
     }
 
+    pub fn float16() -> Self {
+        Float16
+    }
+
+    pub fn float128() -> Self {
+        Float128
+    }
+
     pub fn float() -> Self {
         Float
     }
@@ -1275,6 +1313,10 @@ impl Type {
             Expr::c_true()
         } else if self.is_float() {
             Expr::float_constant(1.0)
+        } else if self.is_float_16() {
+            Expr::float16_constant(1.0)
+        } else if self.is_float_128() {
+            Expr::float128_constant(1.0)
         } else if self.is_double() {
             Expr::double_constant(1.0)
         } else {
@@ -1291,6 +1333,10 @@ impl Type {
             Expr::c_false()
         } else if self.is_float() {
             Expr::float_constant(0.0)
+        } else if self.is_float_16() {
+            Expr::float16_constant(0.0)
+        } else if self.is_float_128() {
+            Expr::float128_constant(0.0)
         } else if self.is_double() {
             Expr::double_constant(0.0)
         } else if self.is_pointer() {
@@ -1309,6 +1355,8 @@ impl Type {
             | CInteger(_)
             | Double
             | Float
+            | Float16
+            | Float128
             | Integer
             | Pointer { .. }
             | Signedbv { .. }
@@ -1413,6 +1461,8 @@ impl Type {
             Type::Empty => "empty".to_string(),
             Type::FlexibleArray { typ } => format!("flexarray_of_{}", typ.to_identifier()),
             Type::Float => "float".to_string(),
+            Type::Float16 => "float16".to_string(),
+            Type::Float128 => "float128".to_string(),
             Type::IncompleteStruct { tag } => tag.to_string(),
             Type::IncompleteUnion { tag } => tag.to_string(),
             Type::InfiniteArray { typ } => {
@@ -1512,6 +1562,8 @@ mod type_tests {
         assert_eq!(type_def.is_unsigned(&mm), src_type.is_unsigned(&mm));
         assert_eq!(type_def.is_scalar(), src_type.is_scalar());
         assert_eq!(type_def.is_float(), src_type.is_float());
+        assert_eq!(type_def.is_float_16(), src_type.is_float_16());
+        assert_eq!(type_def.is_float_128(), src_type.is_float_128());
         assert_eq!(type_def.is_floating_point(), src_type.is_floating_point());
         assert_eq!(type_def.width(), src_type.width());
         assert_eq!(type_def.can_be_lvalue(), src_type.can_be_lvalue());
diff --git a/cprover_bindings/src/irep/irep_id.rs b/cprover_bindings/src/irep/irep_id.rs
index b03a91639aa8..69962edf150e 100644
--- a/cprover_bindings/src/irep/irep_id.rs
+++ b/cprover_bindings/src/irep/irep_id.rs
@@ -283,6 +283,8 @@ pub enum IrepId {
     Short,
     Long,
     Float,
+    Float16,
+    Float128,
     Double,
     Byte,
     Boolean,
@@ -1157,6 +1159,8 @@ impl Display for IrepId {
             IrepId::Short => "short",
             IrepId::Long => "long",
             IrepId::Float => "float",
+            IrepId::Float16 => "float16",
+            IrepId::Float128 => "float128",
             IrepId::Double => "double",
             IrepId::Byte => "byte",
             IrepId::Boolean => "boolean",
diff --git a/cprover_bindings/src/irep/to_irep.rs b/cprover_bindings/src/irep/to_irep.rs
index 81ca9ca10313..d368d5772398 100644
--- a/cprover_bindings/src/irep/to_irep.rs
+++ b/cprover_bindings/src/irep/to_irep.rs
@@ -254,6 +254,25 @@ impl ToIrep for ExprValue {
                     )],
                 }
             }
+            ExprValue::Float16Constant(i) => {
+                let c: u16 = i.to_bits();
+                Irep {
+                    id: IrepId::Constant,
+                    sub: vec![],
+                    named_sub: linear_map![(IrepId::Value, Irep::just_bitpattern_id(c, 16, false))],
+                }
+            }
+            ExprValue::Float128Constant(i) => {
+                let c: u128 = i.to_bits();
+                Irep {
+                    id: IrepId::Constant,
+                    sub: vec![],
+                    named_sub: linear_map![(
+                        IrepId::Value,
+                        Irep::just_bitpattern_id(c, 128, false)
+                    )],
+                }
+            }
             ExprValue::FunctionCall { function, arguments } => side_effect_irep(
                 IrepId::FunctionCall,
                 vec![function.to_irep(mm), arguments_irep(arguments.iter(), mm)],
@@ -370,15 +389,32 @@ impl ToIrep for Location {
                 (IrepId::Function, Irep::just_string_id(function_name.to_string())),
             ])
             .with_named_sub_option(IrepId::Line, line.map(Irep::just_int_id)),
-            Location::Loc { file, function, start_line, start_col, end_line: _, end_col: _ } => {
-                Irep::just_named_sub(linear_map![
-                    (IrepId::File, Irep::just_string_id(file.to_string())),
-                    (IrepId::Line, Irep::just_int_id(*start_line)),
-                ])
-                .with_named_sub_option(IrepId::Column, start_col.map(Irep::just_int_id))
-                .with_named_sub_option(IrepId::Function, function.map(Irep::just_string_id))
-            }
-            Location::Property { file, function, line, col, property_class, comment } => {
+            Location::Loc {
+                file,
+                function,
+                start_line,
+                start_col,
+                end_line: _,
+                end_col: _,
+                pragmas,
+            } => Irep::just_named_sub(linear_map![
+                (IrepId::File, Irep::just_string_id(file.to_string())),
+                (IrepId::Line, Irep::just_int_id(*start_line)),
+            ])
+            .with_named_sub_option(IrepId::Column, start_col.map(Irep::just_int_id))
+            .with_named_sub_option(IrepId::Function, function.map(Irep::just_string_id))
+            .with_named_sub_option(
+                IrepId::Pragma,
+                Some(Irep::just_named_sub(
+                    pragmas
+                        .iter()
+                        .map(|pragma| {
+                            (IrepId::from_string(*pragma), Irep::just_id(IrepId::EmptyString))
+                        })
+                        .collect(),
+                )),
+            ),
+            Location::Property { file, function, line, col, property_class, comment, pragmas } => {
                 Irep::just_named_sub(linear_map![
                     (IrepId::File, Irep::just_string_id(file.to_string())),
                     (IrepId::Line, Irep::just_int_id(*line)),
@@ -390,6 +426,17 @@ impl ToIrep for Location {
                     IrepId::PropertyClass,
                     Irep::just_string_id(property_class.to_string()),
                 )
+                .with_named_sub_option(
+                    IrepId::Pragma,
+                    Some(Irep::just_named_sub(
+                        pragmas
+                            .iter()
+                            .map(|pragma| {
+                                (IrepId::from_string(*pragma), Irep::just_id(IrepId::EmptyString))
+                            })
+                            .collect(),
+                    )),
+                )
             }
             Location::PropertyUnknownLocation { property_class, comment } => {
                 Irep::just_named_sub(linear_map![
@@ -695,6 +742,30 @@ impl ToIrep for Type {
                     (IrepId::CCType, Irep::just_id(IrepId::Float)),
                 ],
             },
+            Type::Float16 => Irep {
+                id: IrepId::Floatbv,
+                sub: vec![],
+                // Fraction bits: 10
+                // Exponent width bits: 5
+                // Sign bit: 1
+                named_sub: linear_map![
+                    (IrepId::F, Irep::just_int_id(10)),
+                    (IrepId::Width, Irep::just_int_id(16)),
+                    (IrepId::CCType, Irep::just_id(IrepId::Float16)),
+                ],
+            },
+            Type::Float128 => Irep {
+                id: IrepId::Floatbv,
+                sub: vec![],
+                // Fraction bits: 112
+                // Exponent width bits: 15
+                // Sign bit: 1
+                named_sub: linear_map![
+                    (IrepId::F, Irep::just_int_id(112)),
+                    (IrepId::Width, Irep::just_int_id(128)),
+                    (IrepId::CCType, Irep::just_id(IrepId::Float128)),
+                ],
+            },
             Type::IncompleteStruct { tag } => Irep {
                 id: IrepId::Struct,
                 sub: vec![],
diff --git a/cprover_bindings/src/lib.rs b/cprover_bindings/src/lib.rs
index 3e5123e0f92d..a5901afbac2d 100644
--- a/cprover_bindings/src/lib.rs
+++ b/cprover_bindings/src/lib.rs
@@ -29,6 +29,9 @@
 //! Speical [irep::Irep::id]s include:
 //! 1. [irep::IrepId::Empty] and [irep::IrepId::Nil] behaves like \[null\].
 
+#![feature(f128)]
+#![feature(f16)]
+
 mod env;
 pub use env::global_dead_object;
 pub mod goto_program;
diff --git a/kani-compiler/Cargo.toml b/kani-compiler/Cargo.toml
index 05002ed1eb27..23389c156302 100644
--- a/kani-compiler/Cargo.toml
+++ b/kani-compiler/Cargo.toml
@@ -3,7 +3,7 @@
 
 [package]
 name = "kani-compiler"
-version = "0.52.0"
+version = "0.53.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 publish = false
diff --git a/kani-compiler/src/args.rs b/kani-compiler/src/args.rs
index b96e1ec43dca..3efc5c0f4f61 100644
--- a/kani-compiler/src/args.rs
+++ b/kani-compiler/src/args.rs
@@ -85,4 +85,6 @@ pub enum ExtraChecks {
     /// Check pointer validity when casting pointers to references.
     /// See https://github.com/model-checking/kani/issues/2975.
     PtrToRefCast,
+    /// Check for using uninitialized memory.
+    Uninit,
 }
diff --git a/kani-compiler/src/codegen_cprover_gotoc/codegen/contract.rs b/kani-compiler/src/codegen_cprover_gotoc/codegen/contract.rs
index 0f27d3f119f7..7f19e5814ce0 100644
--- a/kani-compiler/src/codegen_cprover_gotoc/codegen/contract.rs
+++ b/kani-compiler/src/codegen_cprover_gotoc/codegen/contract.rs
@@ -3,7 +3,7 @@
 use crate::codegen_cprover_gotoc::GotocCtx;
 use crate::kani_middle::attributes::KaniAttributes;
 use cbmc::goto_program::FunctionContract;
-use cbmc::goto_program::{Lambda, Location};
+use cbmc::goto_program::{Expr, Lambda, Location, Type};
 use kani_metadata::AssignsContract;
 use rustc_hir::def_id::DefId as InternalDefId;
 use rustc_smir::rustc_internal;
@@ -12,6 +12,8 @@ use stable_mir::mir::Local;
 use stable_mir::CrateDef;
 use tracing::debug;
 
+use stable_mir::ty::{RigidTy, TyKind};
+
 impl<'tcx> GotocCtx<'tcx> {
     /// Given the `proof_for_contract` target `function_under_contract` and the reachable `items`,
     /// find or create the `AssignsContract` that needs to be enforced and attach it to the symbol
@@ -118,15 +120,89 @@ impl<'tcx> GotocCtx<'tcx> {
             .typ
             .clone();
 
+        let shadow_memory_assign = self
+            .tcx
+            .all_diagnostic_items(())
+            .name_to_id
+            .get(&rustc_span::symbol::Symbol::intern("KaniMemoryInitializationState"))
+            .map(|attr_id| {
+                self.tcx
+                    .symbol_name(rustc_middle::ty::Instance::mono(self.tcx, *attr_id))
+                    .name
+                    .to_string()
+            })
+            .and_then(|shadow_memory_table| self.symbol_table.lookup(&shadow_memory_table).cloned())
+            .map(|shadow_memory_symbol| {
+                vec![Lambda::as_contract_for(
+                    &goto_annotated_fn_typ,
+                    None,
+                    shadow_memory_symbol.to_expr(),
+                )]
+            })
+            .unwrap_or_default();
+
         let assigns = modified_places
             .into_iter()
             .map(|local| {
-                Lambda::as_contract_for(
-                    &goto_annotated_fn_typ,
-                    None,
-                    self.codegen_place_stable(&local.into(), loc).unwrap().goto_expr.dereference(),
-                )
+                if self.is_fat_pointer_stable(self.local_ty_stable(local)) {
+                    let unref = match self.local_ty_stable(local).kind() {
+                        TyKind::RigidTy(RigidTy::Ref(_, ty, _)) => ty,
+                        kind => unreachable!("{:?} is not a reference", kind),
+                    };
+                    let size = match unref.kind() {
+                        TyKind::RigidTy(RigidTy::Slice(elt_type)) => {
+                            elt_type.layout().unwrap().shape().size.bytes()
+                        }
+                        TyKind::RigidTy(RigidTy::Str) => 1,
+                        // For adt, see https://rust-lang.zulipchat.com/#narrow/stream/182449-t-compiler.2Fhelp
+                        TyKind::RigidTy(RigidTy::Adt(..)) => {
+                            todo!("Adt fat pointers not implemented")
+                        }
+                        kind => unreachable!("Generating a slice fat pointer to {:?}", kind),
+                    };
+                    Lambda::as_contract_for(
+                        &goto_annotated_fn_typ,
+                        None,
+                        Expr::symbol_expression(
+                            "__CPROVER_object_upto",
+                            Type::code(
+                                vec![
+                                    Type::empty()
+                                        .to_pointer()
+                                        .as_parameter(None, Some("ptr".into())),
+                                    Type::size_t().as_parameter(None, Some("size".into())),
+                                ],
+                                Type::empty(),
+                            ),
+                        )
+                        .call(vec![
+                            self.codegen_place_stable(&local.into(), loc)
+                                .unwrap()
+                                .goto_expr
+                                .member("data", &self.symbol_table)
+                                .cast_to(Type::empty().to_pointer()),
+                            self.codegen_place_stable(&local.into(), loc)
+                                .unwrap()
+                                .goto_expr
+                                .member("len", &self.symbol_table)
+                                .mul(Expr::size_constant(
+                                    size.try_into().unwrap(),
+                                    &self.symbol_table,
+                                )),
+                        ]),
+                    )
+                } else {
+                    Lambda::as_contract_for(
+                        &goto_annotated_fn_typ,
+                        None,
+                        self.codegen_place_stable(&local.into(), loc)
+                            .unwrap()
+                            .goto_expr
+                            .dereference(),
+                    )
+                }
             })
+            .chain(shadow_memory_assign)
             .collect();
 
         FunctionContract::new(assigns)
diff --git a/kani-compiler/src/codegen_cprover_gotoc/codegen/operand.rs b/kani-compiler/src/codegen_cprover_gotoc/codegen/operand.rs
index 7388ca44a5b7..5549edcced25 100644
--- a/kani-compiler/src/codegen_cprover_gotoc/codegen/operand.rs
+++ b/kani-compiler/src/codegen_cprover_gotoc/codegen/operand.rs
@@ -184,12 +184,18 @@ impl<'tcx> GotocCtx<'tcx> {
             // Instead, we use integers with the right width to represent the bit pattern.
             {
                 match k {
+                    FloatTy::F16 => Some(Expr::float16_constant_from_bitpattern(
+                        alloc.read_uint().unwrap() as u16,
+                    )),
                     FloatTy::F32 => Some(Expr::float_constant_from_bitpattern(
                         alloc.read_uint().unwrap() as u32,
                     )),
                     FloatTy::F64 => Some(Expr::double_constant_from_bitpattern(
                         alloc.read_uint().unwrap() as u64,
                     )),
+                    FloatTy::F128 => {
+                        Some(Expr::float128_constant_from_bitpattern(alloc.read_uint().unwrap()))
+                    }
                 }
             }
             TyKind::RigidTy(RigidTy::RawPtr(inner_ty, _))
diff --git a/kani-compiler/src/codegen_cprover_gotoc/codegen/rvalue.rs b/kani-compiler/src/codegen_cprover_gotoc/codegen/rvalue.rs
index 407ff261f6ab..f84708b9bdd5 100644
--- a/kani-compiler/src/codegen_cprover_gotoc/codegen/rvalue.rs
+++ b/kani-compiler/src/codegen_cprover_gotoc/codegen/rvalue.rs
@@ -57,7 +57,7 @@ impl<'tcx> GotocCtx<'tcx> {
     ) -> Expr {
         debug!(?op, ?left_op, ?right_op, "codegen_comparison_fat_ptr");
         let left_typ = self.operand_ty_stable(left_op);
-        let right_typ = self.operand_ty_stable(left_op);
+        let right_typ = self.operand_ty_stable(right_op);
         assert_eq!(left_typ, right_typ, "Cannot compare pointers of different types");
         assert!(self.is_fat_pointer_stable(left_typ));
 
@@ -703,8 +703,10 @@ impl<'tcx> GotocCtx<'tcx> {
                         if meta.typ().sizeof(&self.symbol_table) == 0 {
                             data_cast
                         } else {
-                            let vtable_expr =
-                                meta.member("_vtable_ptr", &self.symbol_table).cast_to(
+                            let vtable_expr = meta
+                                .member("_vtable_ptr", &self.symbol_table)
+                                .member("pointer", &self.symbol_table)
+                                .cast_to(
                                     typ.lookup_field_type("vtable", &self.symbol_table).unwrap(),
                                 );
                             dynamic_fat_ptr(typ, data_cast, vtable_expr, &self.symbol_table)
@@ -835,13 +837,29 @@ impl<'tcx> GotocCtx<'tcx> {
                             dst_goto_typ.lookup_components(&self.symbol_table).unwrap();
                         assert_eq!(dst_components.len(), 2);
                         assert_eq!(dst_components[0].name(), "_vtable_ptr");
-                        assert!(dst_components[0].typ().is_pointer());
+                        assert!(dst_components[0].typ().is_struct_like());
                         assert_eq!(dst_components[1].name(), "_phantom");
                         self.assert_is_rust_phantom_data_like(&dst_components[1].typ());
+                        // accessing pointer type of _vtable_ptr, which is wrapped in NonNull
+                        let vtable_ptr_typ = dst_goto_typ
+                            .lookup_field_type("_vtable_ptr", &self.symbol_table)
+                            .unwrap()
+                            .lookup_components(&self.symbol_table)
+                            .unwrap()[0]
+                            .typ();
                         Expr::struct_expr(
-                            dst_goto_typ,
+                            dst_goto_typ.clone(),
                             btree_string_map![
-                                ("_vtable_ptr", vtable_expr.cast_to(dst_components[0].typ())),
+                                (
+                                    "_vtable_ptr",
+                                    Expr::struct_expr_from_values(
+                                        dst_goto_typ
+                                            .lookup_field_type("_vtable_ptr", &self.symbol_table)
+                                            .unwrap(),
+                                        vec![vtable_expr.clone().cast_to(vtable_ptr_typ)],
+                                        &self.symbol_table
+                                    )
+                                ),
                                 (
                                     "_phantom",
                                     Expr::struct_expr(
diff --git a/kani-compiler/src/codegen_cprover_gotoc/codegen/span.rs b/kani-compiler/src/codegen_cprover_gotoc/codegen/span.rs
index aadb4fbebed9..41a3da11324b 100644
--- a/kani-compiler/src/codegen_cprover_gotoc/codegen/span.rs
+++ b/kani-compiler/src/codegen_cprover_gotoc/codegen/span.rs
@@ -5,9 +5,31 @@
 
 use crate::codegen_cprover_gotoc::GotocCtx;
 use cbmc::goto_program::Location;
+use lazy_static::lazy_static;
+use rustc_ast::Attribute;
 use rustc_smir::rustc_internal;
 use rustc_span::Span;
 use stable_mir::ty::Span as SpanStable;
+use std::collections::HashMap;
+
+lazy_static! {
+    /// Pragmas key-value store to prevent CBMC from generating automatic checks.
+    /// This list is taken from https://github.com/diffblue/cbmc/blob/develop/regression/cbmc/pragma_cprover_enable_all/main.c.
+    static ref PRAGMAS: HashMap<&'static str, &'static str> =
+        [("bounds", "disable:bounds-check"),
+         ("pointer", "disable:pointer-check"),
+         ("div-by-zero", "disable:div-by-zero-check"),
+         ("float-div-by-zero", "disable:float-div-by-zero-check"),
+         ("enum-range", "disable:enum-range-check"),
+         ("signed-overflow", "disable:signed-overflow-check"),
+         ("unsigned-overflow", "disable:unsigned-overflow-check"),
+         ("pointer-overflow", "disable:pointer-overflow-check"),
+         ("float-overflow", "disable:float-overflow-check"),
+         ("conversion", "disable:conversion-check"),
+         ("undefined-shift", "disable:undefined-shift-check"),
+         ("nan", "disable:nan-check"),
+         ("pointer-primitive", "disable:pointer-primitive-check")].iter().copied().collect();
+}
 
 impl<'tcx> GotocCtx<'tcx> {
     pub fn codegen_span(&self, sp: &Span) -> Location {
@@ -15,6 +37,36 @@ impl<'tcx> GotocCtx<'tcx> {
     }
 
     pub fn codegen_span_stable(&self, sp: SpanStable) -> Location {
+        // Attribute to mark functions as where automatic pointer checks should not be generated.
+        let should_skip_ptr_checks_attr = vec![
+            rustc_span::symbol::Symbol::intern("kanitool"),
+            rustc_span::symbol::Symbol::intern("disable_checks"),
+        ];
+        let pragmas: &'static [&str] = {
+            let disabled_checks: Vec<_> = self
+                .current_fn
+                .as_ref()
+                .map(|current_fn| {
+                    let instance = current_fn.instance();
+                    self.tcx
+                        .get_attrs_by_path(instance.def.def_id(), &should_skip_ptr_checks_attr)
+                        .collect()
+                })
+                .unwrap_or_default();
+            disabled_checks
+                .iter()
+                .map(|attr| {
+                    let arg = parse_word(attr).expect(
+                        "incorrect value passed to `disable_checks`, expected a single identifier",
+                    );
+                    *PRAGMAS.get(arg.as_str()).expect(format!(
+                        "attempting to disable an unexisting check, the possible options are {:?}",
+                        PRAGMAS.keys()
+                    ).as_str())
+                })
+                .collect::<Vec<_>>()
+                .leak() // This is to preserve `Location` being Copy, but could blow up the memory utilization of compiler. 
+        };
         let loc = sp.get_lines();
         Location::new(
             sp.get_filename().to_string(),
@@ -23,6 +75,7 @@ impl<'tcx> GotocCtx<'tcx> {
             Some(loc.start_col),
             loc.end_line,
             Some(loc.end_col),
+            pragmas,
         )
     }
 
@@ -39,3 +92,18 @@ impl<'tcx> GotocCtx<'tcx> {
         self.codegen_span(&topmost)
     }
 }
+
+/// Extracts the single argument from the attribute provided as a string.
+/// For example, `disable_checks(foo)` return `Some("foo")`
+fn parse_word(attr: &Attribute) -> Option<String> {
+    // Vector of meta items , that contain the arguments given the attribute
+    let attr_args = attr.meta_item_list()?;
+    // Only extracts one string ident as a string
+    if attr_args.len() == 1 {
+        attr_args[0].ident().map(|ident| ident.to_string())
+    }
+    // Return none if there are no attributes or if there's too many attributes
+    else {
+        None
+    }
+}
diff --git a/kani-compiler/src/codegen_cprover_gotoc/codegen/typ.rs b/kani-compiler/src/codegen_cprover_gotoc/codegen/typ.rs
index 6d00bda5bce4..1703335dda51 100644
--- a/kani-compiler/src/codegen_cprover_gotoc/codegen/typ.rs
+++ b/kani-compiler/src/codegen_cprover_gotoc/codegen/typ.rs
@@ -130,6 +130,8 @@ impl<'tcx> GotocCtx<'tcx> {
                 Type::Empty => todo!(),
                 Type::FlexibleArray { .. } => todo!(),
                 Type::Float => write!(out, "f32")?,
+                Type::Float16 => write!(out, "f16")?,
+                Type::Float128 => write!(out, "f128")?,
                 Type::IncompleteStruct { .. } => todo!(),
                 Type::IncompleteUnion { .. } => todo!(),
                 Type::InfiniteArray { .. } => todo!(),
@@ -542,9 +544,8 @@ impl<'tcx> GotocCtx<'tcx> {
             ty::Float(k) => match k {
                 FloatTy::F32 => Type::float(),
                 FloatTy::F64 => Type::double(),
-                // `F16` and `F128` are not yet handled.
-                // Tracked here: <https://github.com/model-checking/kani/issues/3069>
-                FloatTy::F16 | FloatTy::F128 => unimplemented!(),
+                FloatTy::F16 => Type::float16(),
+                FloatTy::F128 => Type::float128(),
             },
             ty::Adt(def, _) if def.repr().simd() => self.codegen_vector(ty),
             ty::Adt(def, subst) => {
@@ -573,7 +574,7 @@ impl<'tcx> GotocCtx<'tcx> {
             ty::Ref(_, t, _) | ty::RawPtr(t, _) => self.codegen_ty_ref(*t),
             ty::FnDef(def_id, args) => {
                 let instance =
-                    Instance::resolve(self.tcx, ty::ParamEnv::reveal_all(), *def_id, args)
+                    Instance::try_resolve(self.tcx, ty::ParamEnv::reveal_all(), *def_id, args)
                         .unwrap()
                         .unwrap();
                 self.codegen_fndef_type(instance)
diff --git a/kani-compiler/src/codegen_cprover_gotoc/compiler_interface.rs b/kani-compiler/src/codegen_cprover_gotoc/compiler_interface.rs
index abb69a655472..986cd00e32a5 100644
--- a/kani-compiler/src/codegen_cprover_gotoc/compiler_interface.rs
+++ b/kani-compiler/src/codegen_cprover_gotoc/compiler_interface.rs
@@ -7,14 +7,14 @@ use crate::args::ReachabilityType;
 use crate::codegen_cprover_gotoc::GotocCtx;
 use crate::kani_middle::analysis;
 use crate::kani_middle::attributes::{is_test_harness_description, KaniAttributes};
+use crate::kani_middle::check_reachable_items;
 use crate::kani_middle::codegen_units::{CodegenUnit, CodegenUnits};
 use crate::kani_middle::metadata::gen_test_metadata;
 use crate::kani_middle::provide;
 use crate::kani_middle::reachability::{
     collect_reachable_items, filter_const_crate_items, filter_crate_items,
 };
-use crate::kani_middle::transform::BodyTransformation;
-use crate::kani_middle::{check_reachable_items, dump_mir_items};
+use crate::kani_middle::transform::{BodyTransformation, GlobalPasses};
 use crate::kani_queries::QueryDb;
 use cbmc::goto_program::Location;
 use cbmc::irep::goto_binary_serde::write_goto_binary_file;
@@ -24,9 +24,7 @@ use kani_metadata::artifact::convert_type;
 use kani_metadata::UnsupportedFeature;
 use kani_metadata::{ArtifactType, HarnessMetadata, KaniMetadata};
 use kani_metadata::{AssignsContract, CompilerArtifactStub};
-use rustc_codegen_ssa::back::archive::{
-    get_native_object_symbols, ArArchiveBuilder, ArchiveBuilder,
-};
+use rustc_codegen_ssa::back::archive::{ArArchiveBuilder, ArchiveBuilder, DEFAULT_OBJECT_READER};
 use rustc_codegen_ssa::back::metadata::create_wrapper_file;
 use rustc_codegen_ssa::traits::CodegenBackend;
 use rustc_codegen_ssa::{CodegenResults, CrateInfo};
@@ -89,11 +87,33 @@ impl GotocCodegenBackend {
         check_contract: Option<InternalDefId>,
         mut transformer: BodyTransformation,
     ) -> (GotocCtx<'tcx>, Vec<MonoItem>, Option<AssignsContract>) {
-        let items = with_timer(
+        let (items, call_graph) = with_timer(
             || collect_reachable_items(tcx, &mut transformer, starting_items),
             "codegen reachability analysis",
         );
-        dump_mir_items(tcx, &mut transformer, &items, &symtab_goto.with_extension("kani.mir"));
+
+        // Retrieve all instances from the currently codegened items.
+        let instances = items
+            .iter()
+            .filter_map(|item| match item {
+                MonoItem::Fn(instance) => Some(*instance),
+                MonoItem::Static(static_def) => {
+                    let instance: Instance = (*static_def).into();
+                    instance.has_body().then_some(instance)
+                }
+                MonoItem::GlobalAsm(_) => None,
+            })
+            .collect();
+
+        // Apply all transformation passes, including global passes.
+        let mut global_passes = GlobalPasses::new(&self.queries.lock().unwrap(), tcx);
+        global_passes.run_global_passes(
+            &mut transformer,
+            tcx,
+            starting_items,
+            instances,
+            call_graph,
+        );
 
         // Follow rustc naming convention (cx is abbrev for context).
         // https://rustc-dev-guide.rust-lang.org/conventions.html#naming-conventions
@@ -402,7 +422,7 @@ impl CodegenBackend for GotocCodegenBackend {
             debug!(?crate_type, ?out_path, "link");
             if *crate_type == CrateType::Rlib {
                 // Emit the `rlib` that contains just one file: `<crate>.rmeta`
-                let mut builder = Box::new(ArArchiveBuilder::new(sess, get_native_object_symbols));
+                let mut builder = Box::new(ArArchiveBuilder::new(sess, &DEFAULT_OBJECT_READER));
                 let tmp_dir = TempFileBuilder::new().prefix("kani").tempdir().unwrap();
                 let path = MaybeTempDir::new(tmp_dir, sess.opts.cg.save_temps);
                 let (metadata, _metadata_position) = create_wrapper_file(
diff --git a/kani-compiler/src/codegen_cprover_gotoc/overrides/hooks.rs b/kani-compiler/src/codegen_cprover_gotoc/overrides/hooks.rs
index fc245fc6f4c9..c0df279932f6 100644
--- a/kani-compiler/src/codegen_cprover_gotoc/overrides/hooks.rs
+++ b/kani-compiler/src/codegen_cprover_gotoc/overrides/hooks.rs
@@ -143,6 +143,41 @@ impl GotocHook for Assert {
     }
 }
 
+struct Check;
+impl GotocHook for Check {
+    fn hook_applies(&self, tcx: TyCtxt, instance: Instance) -> bool {
+        matches_function(tcx, instance.def, "KaniCheck")
+    }
+
+    fn handle(
+        &self,
+        gcx: &mut GotocCtx,
+        _instance: Instance,
+        mut fargs: Vec<Expr>,
+        _assign_to: &Place,
+        target: Option<BasicBlockIdx>,
+        span: Span,
+    ) -> Stmt {
+        assert_eq!(fargs.len(), 2);
+        let cond = fargs.remove(0).cast_to(Type::bool());
+        let msg = fargs.remove(0);
+        let msg = gcx.extract_const_message(&msg).unwrap();
+        let target = target.unwrap();
+        let caller_loc = gcx.codegen_caller_span_stable(span);
+
+        let (msg, reach_stmt) = gcx.codegen_reachability_check(msg, span);
+
+        Stmt::block(
+            vec![
+                reach_stmt,
+                gcx.codegen_assert(cond, PropertyClass::Assertion, &msg, caller_loc),
+                Stmt::goto(bb_label(target), caller_loc),
+            ],
+            caller_loc,
+        )
+    }
+}
+
 struct Nondet;
 
 impl GotocHook for Nondet {
@@ -510,6 +545,7 @@ pub fn fn_hooks() -> GotocHooks {
             Rc::new(Panic),
             Rc::new(Assume),
             Rc::new(Assert),
+            Rc::new(Check),
             Rc::new(Cover),
             Rc::new(Nondet),
             Rc::new(IsAllocated),
diff --git a/kani-compiler/src/kani_middle/attributes.rs b/kani-compiler/src/kani_middle/attributes.rs
index b7d8feeee886..9eb6d3d6ee4e 100644
--- a/kani-compiler/src/kani_middle/attributes.rs
+++ b/kani-compiler/src/kani_middle/attributes.rs
@@ -74,6 +74,9 @@ enum KaniAttributeKind {
     /// We use this attribute to properly instantiate `kani::any_modifies` in
     /// cases when recursion is present given our contracts instrumentation.
     Recursion,
+    /// Used to mark functions where generating automatic pointer checks should be disabled. This is
+    /// used later to automatically attach pragma statements to locations.
+    DisableChecks,
 }
 
 impl KaniAttributeKind {
@@ -93,7 +96,8 @@ impl KaniAttributeKind {
             | KaniAttributeKind::CheckedWith
             | KaniAttributeKind::Modifies
             | KaniAttributeKind::InnerCheck
-            | KaniAttributeKind::IsContractGenerated => false,
+            | KaniAttributeKind::IsContractGenerated
+            | KaniAttributeKind::DisableChecks => false,
         }
     }
 
@@ -382,6 +386,10 @@ impl<'tcx> KaniAttributes<'tcx> {
                 KaniAttributeKind::InnerCheck => {
                     self.inner_check();
                 }
+                KaniAttributeKind::DisableChecks => {
+                    // Ignored here, because it should be an internal attribute. Actual validation
+                    // happens when pragmas are generated.
+                }
             }
         }
     }
@@ -490,6 +498,10 @@ impl<'tcx> KaniAttributes<'tcx> {
                 | KaniAttributeKind::InnerCheck
                 | KaniAttributeKind::ReplacedWith => {
                     self.tcx.dcx().span_err(self.tcx.def_span(self.item), format!("Contracts are not supported on harnesses. (Found the kani-internal contract attribute `{}`)", kind.as_ref()));
+                },
+                KaniAttributeKind::DisableChecks => {
+                    // Internal attribute which shouldn't exist here.
+                    unreachable!()
                 }
             };
             harness
@@ -1034,10 +1046,9 @@ fn attr_kind(tcx: TyCtxt, attr: &Attribute) -> Option<KaniAttributeKind> {
                     .intersperse("::")
                     .collect::<String>();
                 KaniAttributeKind::try_from(ident_str.as_str())
-                    .map_err(|err| {
+                    .inspect_err(|&err| {
                         debug!(?err, "attr_kind_failed");
                         tcx.dcx().span_err(attr.span, format!("unknown attribute `{ident_str}`"));
-                        err
                     })
                     .ok()
             } else {
diff --git a/kani-compiler/src/kani_middle/intrinsics.rs b/kani-compiler/src/kani_middle/intrinsics.rs
index 82a75a91f1ad..73e42be00e7b 100644
--- a/kani-compiler/src/kani_middle/intrinsics.rs
+++ b/kani-compiler/src/kani_middle/intrinsics.rs
@@ -77,7 +77,7 @@ impl<'tcx> ModelIntrinsics<'tcx> {
             let Operand::Constant(fn_def) = func else { unreachable!() };
             fn_def.const_ = mirConst::from_value(
                 ConstValue::ZeroSized,
-                tcx.type_of(stub_id).instantiate(tcx, &new_gen_args),
+                tcx.type_of(stub_id).instantiate(tcx, &*new_gen_args),
             );
         } else {
             debug!(?arg_ty, "replace_simd_bitmask failed");
diff --git a/kani-compiler/src/kani_middle/mod.rs b/kani-compiler/src/kani_middle/mod.rs
index 17b08b687e30..3c300e9da52c 100644
--- a/kani-compiler/src/kani_middle/mod.rs
+++ b/kani-compiler/src/kani_middle/mod.rs
@@ -4,9 +4,7 @@
 //! and transformations.
 
 use std::collections::HashSet;
-use std::path::Path;
 
-use crate::kani_middle::transform::BodyTransformation;
 use crate::kani_queries::QueryDb;
 use rustc_hir::{def::DefKind, def_id::LOCAL_CRATE};
 use rustc_middle::span_bug;
@@ -15,18 +13,14 @@ use rustc_middle::ty::layout::{
     LayoutOfHelpers, TyAndLayout,
 };
 use rustc_middle::ty::{self, Instance as InstanceInternal, Ty as TyInternal, TyCtxt};
-use rustc_session::config::OutputType;
 use rustc_smir::rustc_internal;
 use rustc_span::source_map::respan;
 use rustc_span::Span;
 use rustc_target::abi::call::FnAbi;
 use rustc_target::abi::{HasDataLayout, TargetDataLayout};
-use stable_mir::mir::mono::{Instance, MonoItem};
+use stable_mir::mir::mono::MonoItem;
 use stable_mir::ty::{FnDef, RigidTy, Span as SpanStable, TyKind};
 use stable_mir::CrateDef;
-use std::fs::File;
-use std::io::BufWriter;
-use std::io::Write;
 
 use self::attributes::KaniAttributes;
 
@@ -92,41 +86,6 @@ pub fn check_reachable_items(tcx: TyCtxt, queries: &QueryDb, items: &[MonoItem])
     tcx.dcx().abort_if_errors();
 }
 
-/// Print MIR for the reachable items if the `--emit mir` option was provided to rustc.
-pub fn dump_mir_items(
-    tcx: TyCtxt,
-    transformer: &mut BodyTransformation,
-    items: &[MonoItem],
-    output: &Path,
-) {
-    /// Convert MonoItem into a DefId.
-    /// Skip stuff that we cannot generate the MIR items.
-    fn get_instance(item: &MonoItem) -> Option<Instance> {
-        match item {
-            // Exclude FnShims and others that cannot be dumped.
-            MonoItem::Fn(instance) => Some(*instance),
-            MonoItem::Static(def) => {
-                let instance: Instance = (*def).into();
-                instance.has_body().then_some(instance)
-            }
-            MonoItem::GlobalAsm(_) => None,
-        }
-    }
-
-    if tcx.sess.opts.output_types.contains_key(&OutputType::Mir) {
-        // Create output buffer.
-        let out_file = File::create(output).unwrap();
-        let mut writer = BufWriter::new(out_file);
-
-        // For each def_id, dump their MIR
-        for instance in items.iter().filter_map(get_instance) {
-            writeln!(writer, "// Item: {} ({})", instance.name(), instance.mangled_name()).unwrap();
-            let body = transformer.body(tcx, instance);
-            let _ = body.dump(&mut writer, &instance.name());
-        }
-    }
-}
-
 /// Structure that represents the source location of a definition.
 /// TODO: Use `InternedString` once we move it out of the cprover_bindings.
 /// <https://github.com/model-checking/kani/issues/2435>
diff --git a/kani-compiler/src/kani_middle/reachability.rs b/kani-compiler/src/kani_middle/reachability.rs
index 279dcf8cc107..d2c9d50515c4 100644
--- a/kani-compiler/src/kani_middle/reachability.rs
+++ b/kani-compiler/src/kani_middle/reachability.rs
@@ -22,6 +22,7 @@ use rustc_data_structures::fingerprint::Fingerprint;
 use rustc_data_structures::fx::FxHashSet;
 use rustc_data_structures::stable_hasher::{HashStable, StableHasher};
 use rustc_middle::ty::{TyCtxt, VtblEntry};
+use rustc_session::config::OutputType;
 use rustc_smir::rustc_internal;
 use stable_mir::mir::alloc::{AllocId, GlobalAlloc};
 use stable_mir::mir::mono::{Instance, InstanceKind, MonoItem, StaticDef};
@@ -32,6 +33,12 @@ use stable_mir::mir::{
 use stable_mir::ty::{Allocation, ClosureKind, ConstantKind, RigidTy, Ty, TyKind};
 use stable_mir::CrateItem;
 use stable_mir::{CrateDef, ItemKind};
+use std::fmt::{Display, Formatter};
+use std::{
+    collections::{HashMap, HashSet},
+    fs::File,
+    io::{BufWriter, Write},
+};
 
 use crate::kani_middle::coercion;
 use crate::kani_middle::coercion::CoercionBase;
@@ -42,7 +49,7 @@ pub fn collect_reachable_items(
     tcx: TyCtxt,
     transformer: &mut BodyTransformation,
     starting_points: &[MonoItem],
-) -> Vec<MonoItem> {
+) -> (Vec<MonoItem>, CallGraph) {
     // For each harness, collect items using the same collector.
     // I.e.: This will return any item that is reachable from one or more of the starting points.
     let mut collector = MonoItemsCollector::new(tcx, transformer);
@@ -62,7 +69,7 @@ pub fn collect_reachable_items(
     // order of the errors and warnings is stable.
     let mut sorted_items: Vec<_> = collector.collected.into_iter().collect();
     sorted_items.sort_by_cached_key(|item| to_fingerprint(tcx, item));
-    sorted_items
+    (sorted_items, collector.call_graph)
 }
 
 /// Collect all (top-level) items in the crate that matches the given predicate.
@@ -118,7 +125,24 @@ where
             }
         }
     }
-    roots
+    roots.into_iter().map(|root| root.item).collect()
+}
+
+/// Reason for introducing an edge in the call graph.
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Hash)]
+enum CollectionReason {
+    DirectCall,
+    IndirectCall,
+    VTableMethod,
+    Static,
+    StaticDrop,
+}
+
+/// A destination of the edge in the call graph.
+#[derive(Clone, Debug, Eq, PartialEq, Hash)]
+struct CollectedItem {
+    item: MonoItem,
+    reason: CollectionReason,
 }
 
 struct MonoItemsCollector<'tcx, 'a> {
@@ -130,8 +154,8 @@ struct MonoItemsCollector<'tcx, 'a> {
     collected: FxHashSet<MonoItem>,
     /// Items enqueued for visiting.
     queue: Vec<MonoItem>,
-    #[cfg(debug_assertions)]
-    call_graph: debug::CallGraph,
+    /// Call graph used for dataflow analysis.
+    call_graph: CallGraph,
 }
 
 impl<'tcx, 'a> MonoItemsCollector<'tcx, 'a> {
@@ -140,8 +164,7 @@ impl<'tcx, 'a> MonoItemsCollector<'tcx, 'a> {
             tcx,
             collected: FxHashSet::default(),
             queue: vec![],
-            #[cfg(debug_assertions)]
-            call_graph: debug::CallGraph::default(),
+            call_graph: CallGraph::default(),
             transformer,
         }
     }
@@ -167,17 +190,17 @@ impl<'tcx, 'a> MonoItemsCollector<'tcx, 'a> {
                         vec![]
                     }
                 };
-                #[cfg(debug_assertions)]
                 self.call_graph.add_edges(to_visit, &next_items);
 
-                self.queue
-                    .extend(next_items.into_iter().filter(|item| !self.collected.contains(item)));
+                self.queue.extend(next_items.into_iter().filter_map(
+                    |CollectedItem { item, .. }| (!self.collected.contains(&item)).then_some(item),
+                ));
             }
         }
     }
 
     /// Visit a function and collect all mono-items reachable from its instructions.
-    fn visit_fn(&mut self, instance: Instance) -> Vec<MonoItem> {
+    fn visit_fn(&mut self, instance: Instance) -> Vec<CollectedItem> {
         let _guard = debug_span!("visit_fn", function=?instance).entered();
         let body = self.transformer.body(self.tcx, instance);
         let mut collector =
@@ -187,19 +210,24 @@ impl<'tcx, 'a> MonoItemsCollector<'tcx, 'a> {
     }
 
     /// Visit a static object and collect drop / initialization functions.
-    fn visit_static(&mut self, def: StaticDef) -> Vec<MonoItem> {
+    fn visit_static(&mut self, def: StaticDef) -> Vec<CollectedItem> {
         let _guard = debug_span!("visit_static", ?def).entered();
         let mut next_items = vec![];
 
         // Collect drop function.
         let static_ty = def.ty();
         let instance = Instance::resolve_drop_in_place(static_ty);
-        next_items.push(instance.into());
+        next_items
+            .push(CollectedItem { item: instance.into(), reason: CollectionReason::StaticDrop });
 
         // Collect initialization.
         let alloc = def.eval_initializer().unwrap();
         for (_, prov) in alloc.provenance.ptrs {
-            next_items.extend(collect_alloc_items(prov.0).into_iter());
+            next_items.extend(
+                collect_alloc_items(prov.0)
+                    .into_iter()
+                    .map(|item| CollectedItem { item, reason: CollectionReason::Static }),
+            );
         }
 
         next_items
@@ -213,7 +241,7 @@ impl<'tcx, 'a> MonoItemsCollector<'tcx, 'a> {
 
 struct MonoItemsFnCollector<'a, 'tcx> {
     tcx: TyCtxt<'tcx>,
-    collected: FxHashSet<MonoItem>,
+    collected: FxHashSet<CollectedItem>,
     body: &'a Body,
 }
 
@@ -251,7 +279,9 @@ impl<'a, 'tcx> MonoItemsFnCollector<'a, 'tcx> {
                 }
             });
             trace!(methods=?methods.clone().collect::<Vec<_>>(), "collect_vtable_methods");
-            self.collected.extend(methods);
+            self.collected.extend(
+                methods.map(|item| CollectedItem { item, reason: CollectionReason::VTableMethod }),
+            );
         }
 
         // Add the destructor for the concrete type.
@@ -282,7 +312,12 @@ impl<'a, 'tcx> MonoItemsFnCollector<'a, 'tcx> {
         };
         if should_collect && should_codegen_locally(&instance) {
             trace!(?instance, "collect_instance");
-            self.collected.insert(instance.into());
+            let reason = if is_direct_call {
+                CollectionReason::DirectCall
+            } else {
+                CollectionReason::IndirectCall
+            };
+            self.collected.insert(CollectedItem { item: instance.into(), reason });
         }
     }
 
@@ -290,7 +325,11 @@ impl<'a, 'tcx> MonoItemsFnCollector<'a, 'tcx> {
     fn collect_allocation(&mut self, alloc: &Allocation) {
         debug!(?alloc, "collect_allocation");
         for (_, id) in &alloc.provenance.ptrs {
-            self.collected.extend(collect_alloc_items(id.0).into_iter())
+            self.collected.extend(
+                collect_alloc_items(id.0)
+                    .into_iter()
+                    .map(|item| CollectedItem { item, reason: CollectionReason::Static }),
+            )
         }
     }
 }
@@ -366,7 +405,8 @@ impl<'a, 'tcx> MirVisitor for MonoItemsFnCollector<'a, 'tcx> {
             }
             Rvalue::ThreadLocalRef(item) => {
                 trace!(?item, "visit_rvalue thread_local");
-                self.collected.insert(MonoItem::Static(StaticDef::try_from(item).unwrap()));
+                let item = MonoItem::Static(StaticDef::try_from(item).unwrap());
+                self.collected.insert(CollectedItem { item, reason: CollectionReason::Static });
             }
             _ => { /* not interesting */ }
         }
@@ -485,128 +525,150 @@ fn collect_alloc_items(alloc_id: AllocId) -> Vec<MonoItem> {
     items
 }
 
-#[cfg(debug_assertions)]
-#[allow(dead_code)]
-mod debug {
-
-    use std::fmt::{Display, Formatter};
-    use std::{
-        collections::{HashMap, HashSet},
-        fs::File,
-        io::{BufWriter, Write},
-    };
-
-    use rustc_session::config::OutputType;
-
-    use super::*;
+/// Call graph with edges annotated with the reason why they were added to the graph.
+#[derive(Debug, Default)]
+pub struct CallGraph {
+    /// Nodes of the graph.
+    nodes: HashSet<Node>,
+    /// Edges of the graph.
+    edges: HashMap<Node, Vec<CollectedNode>>,
+    /// Since the graph is directed, we also store back edges.
+    back_edges: HashMap<Node, Vec<CollectedNode>>,
+}
 
-    #[derive(Debug, Default)]
-    pub struct CallGraph {
-        // Nodes of the graph.
-        nodes: HashSet<Node>,
-        edges: HashMap<Node, Vec<Node>>,
-        back_edges: HashMap<Node, Vec<Node>>,
+/// Newtype around MonoItem.
+#[derive(Clone, Debug, Eq, PartialEq, Hash)]
+struct Node(pub MonoItem);
+
+/// Newtype around CollectedItem.
+#[derive(Clone, Debug, Eq, PartialEq, Hash)]
+struct CollectedNode(pub CollectedItem);
+
+impl CallGraph {
+    /// Add a new node into a graph.
+    fn add_node(&mut self, item: MonoItem) {
+        let node = Node(item);
+        self.nodes.insert(node.clone());
+        self.edges.entry(node.clone()).or_default();
+        self.back_edges.entry(node).or_default();
     }
 
-    #[derive(Clone, Debug, Eq, PartialEq, Hash)]
-    struct Node(pub MonoItem);
-
-    impl CallGraph {
-        pub fn add_node(&mut self, item: MonoItem) {
-            let node = Node(item);
-            self.nodes.insert(node.clone());
-            self.edges.entry(node.clone()).or_default();
-            self.back_edges.entry(node).or_default();
-        }
+    /// Add a new edge "from" -> "to".
+    fn add_edge(&mut self, from: MonoItem, to: MonoItem, collection_reason: CollectionReason) {
+        let from_node = Node(from.clone());
+        let to_node = Node(to.clone());
+        self.add_node(from.clone());
+        self.add_node(to.clone());
+        self.edges
+            .get_mut(&from_node)
+            .unwrap()
+            .push(CollectedNode(CollectedItem { item: to, reason: collection_reason }));
+        self.back_edges
+            .get_mut(&to_node)
+            .unwrap()
+            .push(CollectedNode(CollectedItem { item: from, reason: collection_reason }));
+    }
 
-        /// Add a new edge "from" -> "to".
-        pub fn add_edge(&mut self, from: MonoItem, to: MonoItem) {
-            let from_node = Node(from.clone());
-            let to_node = Node(to.clone());
-            self.add_node(from);
-            self.add_node(to);
-            self.edges.get_mut(&from_node).unwrap().push(to_node.clone());
-            self.back_edges.get_mut(&to_node).unwrap().push(from_node);
+    /// Add multiple new edges for the "from" node.
+    fn add_edges(&mut self, from: MonoItem, to: &[CollectedItem]) {
+        self.add_node(from.clone());
+        for CollectedItem { item, reason } in to {
+            self.add_edge(from.clone(), item.clone(), *reason);
         }
+    }
 
-        /// Add multiple new edges for the "from" node.
-        pub fn add_edges(&mut self, from: MonoItem, to: &[MonoItem]) {
-            self.add_node(from.clone());
-            for item in to {
-                self.add_edge(from.clone(), item.clone());
+    /// Print the graph in DOT format to a file.
+    /// See <https://graphviz.org/doc/info/lang.html> for more information.
+    fn dump_dot(&self, tcx: TyCtxt) -> std::io::Result<()> {
+        if let Ok(target) = std::env::var("KANI_REACH_DEBUG") {
+            debug!(?target, "dump_dot");
+            let outputs = tcx.output_filenames(());
+            let base_path = outputs.path(OutputType::Metadata);
+            let path = base_path.as_path().with_extension("dot");
+            let out_file = File::create(path)?;
+            let mut writer = BufWriter::new(out_file);
+            writeln!(writer, "digraph ReachabilityGraph {{")?;
+            if target.is_empty() {
+                self.dump_all(&mut writer)?;
+            } else {
+                // Only dump nodes that led the reachability analysis to the target node.
+                self.dump_reason(&mut writer, &target)?;
             }
+            writeln!(writer, "}}")?;
         }
 
-        /// Print the graph in DOT format to a file.
-        /// See <https://graphviz.org/doc/info/lang.html> for more information.
-        pub fn dump_dot(&self, tcx: TyCtxt) -> std::io::Result<()> {
-            if let Ok(target) = std::env::var("KANI_REACH_DEBUG") {
-                debug!(?target, "dump_dot");
-                let outputs = tcx.output_filenames(());
-                let base_path = outputs.path(OutputType::Metadata);
-                let path = base_path.as_path().with_extension("dot");
-                let out_file = File::create(path)?;
-                let mut writer = BufWriter::new(out_file);
-                writeln!(writer, "digraph ReachabilityGraph {{")?;
-                if target.is_empty() {
-                    self.dump_all(&mut writer)?;
-                } else {
-                    // Only dump nodes that led the reachability analysis to the target node.
-                    self.dump_reason(&mut writer, &target)?;
-                }
-                writeln!(writer, "}}")?;
-            }
+        Ok(())
+    }
 
-            Ok(())
+    /// Write all notes to the given writer.
+    fn dump_all<W: Write>(&self, writer: &mut W) -> std::io::Result<()> {
+        tracing::info!(nodes=?self.nodes.len(), edges=?self.edges.len(), "dump_all");
+        for node in &self.nodes {
+            writeln!(writer, r#""{node}""#)?;
+            for succ in self.edges.get(node).unwrap() {
+                let reason = succ.0.reason;
+                writeln!(writer, r#""{node}" -> "{succ}" [label={reason:?}] "#)?;
+            }
         }
+        Ok(())
+    }
 
-        /// Write all notes to the given writer.
-        fn dump_all<W: Write>(&self, writer: &mut W) -> std::io::Result<()> {
-            tracing::info!(nodes=?self.nodes.len(), edges=?self.edges.len(), "dump_all");
-            for node in &self.nodes {
-                writeln!(writer, r#""{node}""#)?;
-                for succ in self.edges.get(node).unwrap() {
-                    writeln!(writer, r#""{node}" -> "{succ}" "#)?;
-                }
+    /// Write all notes that may have led to the discovery of the given target.
+    fn dump_reason<W: Write>(&self, writer: &mut W, target: &str) -> std::io::Result<()> {
+        let mut queue: Vec<Node> =
+            self.nodes.iter().filter(|item| item.to_string().contains(target)).cloned().collect();
+        let mut visited: HashSet<Node> = HashSet::default();
+        tracing::info!(target=?queue, nodes=?self.nodes.len(), edges=?self.edges.len(), "dump_reason");
+        while let Some(to_visit) = queue.pop() {
+            if !visited.contains(&to_visit) {
+                visited.insert(to_visit.clone());
+                queue.extend(
+                    self.back_edges
+                        .get(&to_visit)
+                        .unwrap()
+                        .iter()
+                        .map(|item| Node::from(item.clone())),
+                );
             }
-            Ok(())
         }
 
-        /// Write all notes that may have led to the discovery of the given target.
-        fn dump_reason<W: Write>(&self, writer: &mut W, target: &str) -> std::io::Result<()> {
-            let mut queue = self
-                .nodes
-                .iter()
-                .filter(|item| item.to_string().contains(target))
-                .collect::<Vec<_>>();
-            let mut visited: HashSet<&Node> = HashSet::default();
-            tracing::info!(target=?queue, nodes=?self.nodes.len(), edges=?self.edges.len(), "dump_reason");
-            while let Some(to_visit) = queue.pop() {
-                if !visited.contains(to_visit) {
-                    visited.insert(to_visit);
-                    queue.extend(self.back_edges.get(to_visit).unwrap());
-                }
+        for node in &visited {
+            writeln!(writer, r#""{node}""#)?;
+            let edges = self.edges.get(node).unwrap();
+            for succ in edges.iter().filter(|item| {
+                let node = Node::from((*item).clone());
+                visited.contains(&node)
+            }) {
+                let reason = succ.0.reason;
+                writeln!(writer, r#""{node}" -> "{succ}" [label={reason:?}] "#)?;
             }
+        }
+        Ok(())
+    }
+}
 
-            for node in &visited {
-                writeln!(writer, r#""{node}""#)?;
-                for succ in
-                    self.edges.get(node).unwrap().iter().filter(|item| visited.contains(item))
-                {
-                    writeln!(writer, r#""{node}" -> "{succ}" "#)?;
-                }
-            }
-            Ok(())
+impl Display for Node {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        match &self.0 {
+            MonoItem::Fn(instance) => write!(f, "{}", instance.name()),
+            MonoItem::Static(def) => write!(f, "{}", def.name()),
+            MonoItem::GlobalAsm(asm) => write!(f, "{asm:?}"),
         }
     }
+}
 
-    impl Display for Node {
-        fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
-            match &self.0 {
-                MonoItem::Fn(instance) => write!(f, "{}", instance.name()),
-                MonoItem::Static(def) => write!(f, "{}", def.name()),
-                MonoItem::GlobalAsm(asm) => write!(f, "{asm:?}"),
-            }
+impl Display for CollectedNode {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        match &self.0.item {
+            MonoItem::Fn(instance) => write!(f, "{}", instance.name()),
+            MonoItem::Static(def) => write!(f, "{}", def.name()),
+            MonoItem::GlobalAsm(asm) => write!(f, "{asm:?}"),
         }
     }
 }
+
+impl From<CollectedNode> for Node {
+    fn from(value: CollectedNode) -> Self {
+        Node(value.0.item)
+    }
+}
diff --git a/kani-compiler/src/kani_middle/transform/body.rs b/kani-compiler/src/kani_middle/transform/body.rs
index 2bf424a1332d..d82dda80cc05 100644
--- a/kani-compiler/src/kani_middle/transform/body.rs
+++ b/kani-compiler/src/kani_middle/transform/body.rs
@@ -37,6 +37,13 @@ pub struct MutableBody {
     span: Span,
 }
 
+/// Denotes whether instrumentation should be inserted before or after the statement.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum InsertPosition {
+    Before,
+    After,
+}
+
 impl MutableBody {
     /// Get the basic blocks of this builder.
     pub fn blocks(&self) -> &[BasicBlock] {
@@ -95,12 +102,13 @@ impl MutableBody {
         from: Operand,
         pointee_ty: Ty,
         mutability: Mutability,
-        before: &mut SourceInstruction,
+        source: &mut SourceInstruction,
+        position: InsertPosition,
     ) -> Local {
         assert!(from.ty(self.locals()).unwrap().kind().is_raw_ptr());
         let target_ty = Ty::new_ptr(pointee_ty, mutability);
         let rvalue = Rvalue::Cast(CastKind::PtrToPtr, from, target_ty);
-        self.new_assignment(rvalue, before)
+        self.new_assignment(rvalue, source, position)
     }
 
     /// Add a new assignment for the given binary operation.
@@ -111,21 +119,27 @@ impl MutableBody {
         bin_op: BinOp,
         lhs: Operand,
         rhs: Operand,
-        before: &mut SourceInstruction,
+        source: &mut SourceInstruction,
+        position: InsertPosition,
     ) -> Local {
         let rvalue = Rvalue::BinaryOp(bin_op, lhs, rhs);
-        self.new_assignment(rvalue, before)
+        self.new_assignment(rvalue, source, position)
     }
 
     /// Add a new assignment.
     ///
     /// Return  local where the result is saved.
-    pub fn new_assignment(&mut self, rvalue: Rvalue, before: &mut SourceInstruction) -> Local {
-        let span = before.span(&self.blocks);
+    pub fn new_assignment(
+        &mut self,
+        rvalue: Rvalue,
+        source: &mut SourceInstruction,
+        position: InsertPosition,
+    ) -> Local {
+        let span = source.span(&self.blocks);
         let ret_ty = rvalue.ty(&self.locals).unwrap();
         let result = self.new_local(ret_ty, span, Mutability::Not);
         let stmt = Statement { kind: StatementKind::Assign(Place::from(result), rvalue), span };
-        self.insert_stmt(stmt, before);
+        self.insert_stmt(stmt, source, position);
         result
     }
 
@@ -139,6 +153,7 @@ impl MutableBody {
         tcx: TyCtxt,
         check_type: &CheckType,
         source: &mut SourceInstruction,
+        position: InsertPosition,
         value: Local,
         msg: &str,
     ) {
@@ -168,7 +183,7 @@ impl MutableBody {
                     unwind: UnwindAction::Terminate,
                 };
                 let terminator = Terminator { kind, span };
-                self.split_bb(source, terminator);
+                self.split_bb(source, position, terminator);
             }
             CheckType::Panic | CheckType::NoCore => {
                 tcx.sess
@@ -182,11 +197,55 @@ impl MutableBody {
         }
     }
 
-    /// Split a basic block right before the source location and use the new terminator
-    /// in the basic block that was split.
+    /// Add a new call to the basic block indicated by the given index.
+    ///
+    /// The new call will have the same span as the source instruction, and the basic block
+    /// will be split. The source instruction will be adjusted to point to the first instruction in
+    /// the new basic block.
+    pub fn add_call(
+        &mut self,
+        callee: &Instance,
+        source: &mut SourceInstruction,
+        position: InsertPosition,
+        args: Vec<Operand>,
+        destination: Place,
+    ) {
+        let new_bb = self.blocks.len();
+        let span = source.span(&self.blocks);
+        let callee_op =
+            Operand::Copy(Place::from(self.new_local(callee.ty(), span, Mutability::Not)));
+        let kind = TerminatorKind::Call {
+            func: callee_op,
+            args,
+            destination,
+            target: Some(new_bb),
+            unwind: UnwindAction::Terminate,
+        };
+        let terminator = Terminator { kind, span };
+        self.split_bb(source, position, terminator);
+    }
+
+    /// Split a basic block and use the new terminator in the basic block that was split.
     ///
     /// The source is updated to point to the same instruction which is now in the new basic block.
-    pub fn split_bb(&mut self, source: &mut SourceInstruction, new_term: Terminator) {
+    pub fn split_bb(
+        &mut self,
+        source: &mut SourceInstruction,
+        position: InsertPosition,
+        new_term: Terminator,
+    ) {
+        match position {
+            InsertPosition::Before => {
+                self.split_bb_before(source, new_term);
+            }
+            InsertPosition::After => {
+                self.split_bb_after(source, new_term);
+            }
+        }
+    }
+
+    /// Split a basic block right before the source location.
+    fn split_bb_before(&mut self, source: &mut SourceInstruction, new_term: Terminator) {
         let new_bb_idx = self.blocks.len();
         let (idx, bb) = match source {
             SourceInstruction::Statement { idx, bb } => {
@@ -196,9 +255,9 @@ impl MutableBody {
                 (orig_idx, orig_bb)
             }
             SourceInstruction::Terminator { bb } => {
-                let orig_bb = *bb;
+                let (orig_idx, orig_bb) = (self.blocks[*bb].statements.len(), *bb);
                 *bb = new_bb_idx;
-                (self.blocks[orig_bb].statements.len(), orig_bb)
+                (orig_idx, orig_bb)
             }
         };
         let old_term = mem::replace(&mut self.blocks[bb].terminator, new_term);
@@ -208,16 +267,95 @@ impl MutableBody {
         self.blocks.push(new_bb);
     }
 
-    /// Insert statement before the source instruction and update the source as needed.
-    pub fn insert_stmt(&mut self, new_stmt: Statement, before: &mut SourceInstruction) {
-        match before {
+    /// Split a basic block right after the source location.
+    fn split_bb_after(&mut self, source: &mut SourceInstruction, mut new_term: Terminator) {
+        let new_bb_idx = self.blocks.len();
+        match source {
+            // Split the current block after the statement located at `source`
+            // and move the remaining statements into the new one.
             SourceInstruction::Statement { idx, bb } => {
-                self.blocks[*bb].statements.insert(*idx, new_stmt);
-                *idx += 1;
+                let (orig_idx, orig_bb) = (*idx, *bb);
+                *idx = 0;
+                *bb = new_bb_idx;
+                let old_term = mem::replace(&mut self.blocks[orig_bb].terminator, new_term);
+                let bb_stmts = &mut self.blocks[orig_bb].statements;
+                let remaining = bb_stmts.split_off(orig_idx + 1);
+                let new_bb = BasicBlock { statements: remaining, terminator: old_term };
+                self.blocks.push(new_bb);
             }
+            // Make the terminator at `source` point at the new block,
+            // the terminator of which is a simple Goto instruction.
             SourceInstruction::Terminator { bb } => {
-                // Append statements at the end of the basic block.
-                self.blocks[*bb].statements.push(new_stmt);
+                let current_terminator = &mut self.blocks.get_mut(*bb).unwrap().terminator;
+                // Kani can only instrument function calls like this.
+                match (&mut current_terminator.kind, &mut new_term.kind) {
+                    (
+                        TerminatorKind::Call { target: Some(target_bb), .. },
+                        TerminatorKind::Call { target: Some(new_target_bb), .. },
+                    ) => {
+                        // Set the new terminator to point where previous terminator pointed.
+                        *new_target_bb = *target_bb;
+                        // Point the current terminator to the new terminator's basic block.
+                        *target_bb = new_bb_idx;
+                        // Update the current poisition.
+                        *bb = new_bb_idx;
+                        self.blocks.push(BasicBlock { statements: vec![], terminator: new_term });
+                    }
+                    _ => unimplemented!("Kani can only split blocks after calls."),
+                };
+            }
+        };
+    }
+
+    /// Insert statement before or after the source instruction and update the source as needed.
+    pub fn insert_stmt(
+        &mut self,
+        new_stmt: Statement,
+        source: &mut SourceInstruction,
+        position: InsertPosition,
+    ) {
+        match position {
+            InsertPosition::Before => {
+                match source {
+                    SourceInstruction::Statement { idx, bb } => {
+                        self.blocks[*bb].statements.insert(*idx, new_stmt);
+                        *idx += 1;
+                    }
+                    SourceInstruction::Terminator { bb } => {
+                        // Append statements at the end of the basic block.
+                        self.blocks[*bb].statements.push(new_stmt);
+                    }
+                }
+            }
+            InsertPosition::After => {
+                let new_bb_idx = self.blocks.len();
+                let span = source.span(&self.blocks);
+                match source {
+                    SourceInstruction::Statement { idx, bb } => {
+                        self.blocks[*bb].statements.insert(*idx + 1, new_stmt);
+                        *idx += 1;
+                    }
+                    SourceInstruction::Terminator { bb } => {
+                        // Create a new basic block, as we need to append a statement after the terminator.
+                        let current_terminator = &mut self.blocks.get_mut(*bb).unwrap().terminator;
+                        // Kani can only instrument function calls in this way.
+                        match &mut current_terminator.kind {
+                            TerminatorKind::Call { target: Some(target_bb), .. } => {
+                                *source = SourceInstruction::Statement { idx: 0, bb: new_bb_idx };
+                                let new_bb = BasicBlock {
+                                    statements: vec![new_stmt],
+                                    terminator: Terminator {
+                                        kind: TerminatorKind::Goto { target: *target_bb },
+                                        span,
+                                    },
+                                };
+                                *target_bb = new_bb_idx;
+                                self.blocks.push(new_bb);
+                            }
+                            _ => unimplemented!("Kani can only insert statements after calls."),
+                        };
+                    }
+                }
             }
         }
     }
@@ -249,12 +387,13 @@ pub enum CheckType {
 }
 
 impl CheckType {
-    /// This will create the type of check that is available in the current crate.
+    /// This will create the type of check that is available in the current crate, attempting to
+    /// create a check that generates an assertion following by an assumption of the same assertion.
     ///
     /// If `kani` crate is available, this will return [CheckType::Assert], and the instance will
     /// point to `kani::assert`. Otherwise, we will collect the `core::panic_str` method and return
     /// [CheckType::Panic].
-    pub fn new(tcx: TyCtxt) -> CheckType {
+    pub fn new_assert_assume(tcx: TyCtxt) -> CheckType {
         if let Some(instance) = find_instance(tcx, "KaniAssert") {
             CheckType::Assert(instance)
         } else if find_instance(tcx, "panic_str").is_some() {
@@ -263,6 +402,22 @@ impl CheckType {
             CheckType::NoCore
         }
     }
+
+    /// This will create the type of check that is available in the current crate, attempting to
+    /// create a check that generates an assertion, without assuming the condition afterwards.
+    ///
+    /// If `kani` crate is available, this will return [CheckType::Assert], and the instance will
+    /// point to `kani::assert`. Otherwise, we will collect the `core::panic_str` method and return
+    /// [CheckType::Panic].
+    pub fn new_assert(tcx: TyCtxt) -> CheckType {
+        if let Some(instance) = find_instance(tcx, "KaniCheck") {
+            CheckType::Assert(instance)
+        } else if find_instance(tcx, "panic_str").is_some() {
+            CheckType::Panic
+        } else {
+            CheckType::NoCore
+        }
+    }
 }
 
 /// We store the index of an instruction to avoid borrow checker issues and unnecessary copies.
diff --git a/kani-compiler/src/kani_middle/transform/check_uninit/mod.rs b/kani-compiler/src/kani_middle/transform/check_uninit/mod.rs
new file mode 100644
index 000000000000..4f94f94d17f1
--- /dev/null
+++ b/kani-compiler/src/kani_middle/transform/check_uninit/mod.rs
@@ -0,0 +1,541 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+//
+//! Implement a transformation pass that instruments the code to detect possible UB due to
+//! the accesses to uninitialized memory.
+
+use crate::args::ExtraChecks;
+use crate::kani_middle::find_fn_def;
+use crate::kani_middle::transform::body::{
+    CheckType, InsertPosition, MutableBody, SourceInstruction,
+};
+use crate::kani_middle::transform::{TransformPass, TransformationType};
+use crate::kani_queries::QueryDb;
+use rustc_middle::ty::TyCtxt;
+use rustc_smir::rustc_internal;
+use stable_mir::mir::mono::Instance;
+use stable_mir::mir::{AggregateKind, Body, ConstOperand, Mutability, Operand, Place, Rvalue};
+use stable_mir::ty::{
+    FnDef, GenericArgKind, GenericArgs, MirConst, RigidTy, Ty, TyConst, TyKind, UintTy,
+};
+use stable_mir::CrateDef;
+use std::collections::{HashMap, HashSet};
+use std::fmt::Debug;
+use tracing::{debug, trace};
+
+mod ty_layout;
+mod uninit_visitor;
+
+pub use ty_layout::{PointeeInfo, PointeeLayout};
+use uninit_visitor::{CheckUninitVisitor, InitRelevantInstruction, MemoryInitOp};
+
+// Function bodies of those functions will not be instrumented as not to cause infinite recursion.
+const SKIPPED_DIAGNOSTIC_ITEMS: &[&str] = &[
+    "KaniIsPtrInitialized",
+    "KaniSetPtrInitialized",
+    "KaniIsSliceChunkPtrInitialized",
+    "KaniSetSliceChunkPtrInitialized",
+    "KaniIsSlicePtrInitialized",
+    "KaniSetSlicePtrInitialized",
+    "KaniIsStrPtrInitialized",
+    "KaniSetStrPtrInitialized",
+];
+
+/// Instrument the code with checks for uninitialized memory.
+#[derive(Debug)]
+pub struct UninitPass {
+    pub check_type: CheckType,
+    /// Used to cache FnDef lookups of injected memory initialization functions.
+    pub mem_init_fn_cache: HashMap<&'static str, FnDef>,
+}
+
+impl TransformPass for UninitPass {
+    fn transformation_type() -> TransformationType
+    where
+        Self: Sized,
+    {
+        TransformationType::Instrumentation
+    }
+
+    fn is_enabled(&self, query_db: &QueryDb) -> bool
+    where
+        Self: Sized,
+    {
+        let args = query_db.args();
+        args.ub_check.contains(&ExtraChecks::Uninit)
+    }
+
+    fn transform(&mut self, tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body) {
+        trace!(function=?instance.name(), "transform");
+
+        // Need to break infinite recursion when memory initialization checks are inserted, so the
+        // internal functions responsible for memory initialization are skipped.
+        if tcx
+            .get_diagnostic_name(rustc_internal::internal(tcx, instance.def.def_id()))
+            .map(|diagnostic_name| {
+                SKIPPED_DIAGNOSTIC_ITEMS.contains(&diagnostic_name.to_ident_string().as_str())
+            })
+            .unwrap_or(false)
+        {
+            return (false, body);
+        }
+
+        let mut new_body = MutableBody::from(body);
+        let orig_len = new_body.blocks().len();
+
+        // Inject a call to set-up memory initialization state if the function is a harness.
+        if is_harness(instance, tcx) {
+            inject_memory_init_setup(&mut new_body, tcx, &mut self.mem_init_fn_cache);
+        }
+
+        // Set of basic block indices for which analyzing first statement should be skipped.
+        //
+        // This is necessary because some checks are inserted before the source instruction, which, in
+        // turn, gets moved to the next basic block. Hence, we would not need to look at the
+        // instruction again as a part of new basic block. However, if the check is inserted after the
+        // source instruction, we still need to look at the first statement of the new basic block, so
+        // we need to keep track of which basic blocks were created as a part of injecting checks after
+        // the source instruction.
+        let mut skip_first = HashSet::new();
+
+        // Do not cache body.blocks().len() since it will change as we add new checks.
+        let mut bb_idx = 0;
+        while bb_idx < new_body.blocks().len() {
+            if let Some(candidate) =
+                CheckUninitVisitor::find_next(&new_body, bb_idx, skip_first.contains(&bb_idx))
+            {
+                self.build_check_for_instruction(tcx, &mut new_body, candidate, &mut skip_first);
+                bb_idx += 1
+            } else {
+                bb_idx += 1;
+            };
+        }
+        (orig_len != new_body.blocks().len(), new_body.into())
+    }
+}
+
+impl UninitPass {
+    /// Inject memory initialization checks for each operation in an instruction.
+    fn build_check_for_instruction(
+        &mut self,
+        tcx: TyCtxt,
+        body: &mut MutableBody,
+        instruction: InitRelevantInstruction,
+        skip_first: &mut HashSet<usize>,
+    ) {
+        debug!(?instruction, "build_check");
+        let mut source = instruction.source;
+        for operation in instruction.before_instruction {
+            self.build_check_for_operation(tcx, body, &mut source, operation, skip_first);
+        }
+        for operation in instruction.after_instruction {
+            self.build_check_for_operation(tcx, body, &mut source, operation, skip_first);
+        }
+    }
+
+    /// Inject memory initialization check for an operation.
+    fn build_check_for_operation(
+        &mut self,
+        tcx: TyCtxt,
+        body: &mut MutableBody,
+        source: &mut SourceInstruction,
+        operation: MemoryInitOp,
+        skip_first: &mut HashSet<usize>,
+    ) {
+        if let MemoryInitOp::Unsupported { reason } | MemoryInitOp::TriviallyUnsafe { reason } =
+            &operation
+        {
+            collect_skipped(&operation, body, skip_first);
+            self.inject_assert_false(tcx, body, source, operation.position(), reason);
+            return;
+        };
+
+        let pointee_ty_info = {
+            let ptr_operand = operation.mk_operand(body, source);
+            let ptr_operand_ty = ptr_operand.ty(body.locals()).unwrap();
+            let pointee_ty = match ptr_operand_ty.kind() {
+                TyKind::RigidTy(RigidTy::RawPtr(pointee_ty, _)) => pointee_ty,
+                _ => {
+                    unreachable!(
+                        "Should only build checks for raw pointers, `{ptr_operand_ty}` encountered."
+                    )
+                }
+            };
+            match PointeeInfo::from_ty(pointee_ty) {
+                Ok(type_info) => type_info,
+                Err(_) => {
+                    let reason = format!(
+                        "Kani currently doesn't support checking memory initialization for pointers to `{pointee_ty}.",
+                    );
+                    collect_skipped(&operation, body, skip_first);
+                    self.inject_assert_false(tcx, body, source, operation.position(), &reason);
+                    return;
+                }
+            }
+        };
+
+        match operation {
+            MemoryInitOp::CheckSliceChunk { .. } | MemoryInitOp::Check { .. } => {
+                self.build_get_and_check(tcx, body, source, operation, pointee_ty_info, skip_first)
+            }
+            MemoryInitOp::SetSliceChunk { .. }
+            | MemoryInitOp::Set { .. }
+            | MemoryInitOp::SetRef { .. } => {
+                self.build_set(tcx, body, source, operation, pointee_ty_info, skip_first)
+            }
+            MemoryInitOp::Unsupported { .. } | MemoryInitOp::TriviallyUnsafe { .. } => {
+                unreachable!()
+            }
+        }
+    }
+
+    /// Inject a load from memory initialization state and an assertion that all non-padding bytes
+    /// are initialized.
+    fn build_get_and_check(
+        &mut self,
+        tcx: TyCtxt,
+        body: &mut MutableBody,
+        source: &mut SourceInstruction,
+        operation: MemoryInitOp,
+        pointee_info: PointeeInfo,
+        skip_first: &mut HashSet<usize>,
+    ) {
+        let ret_place = Place {
+            local: body.new_local(Ty::bool_ty(), source.span(body.blocks()), Mutability::Not),
+            projection: vec![],
+        };
+        let ptr_operand = operation.mk_operand(body, source);
+        match pointee_info.layout() {
+            PointeeLayout::Sized { layout } => {
+                let layout_operand = mk_layout_operand(body, source, operation.position(), &layout);
+                // Depending on whether accessing the known number of elements in the slice, need to
+                // pass is as an argument.
+                let (diagnostic, args) = match &operation {
+                    MemoryInitOp::Check { .. } => {
+                        let diagnostic = "KaniIsPtrInitialized";
+                        let args = vec![ptr_operand.clone(), layout_operand];
+                        (diagnostic, args)
+                    }
+                    MemoryInitOp::CheckSliceChunk { .. } => {
+                        let diagnostic = "KaniIsSliceChunkPtrInitialized";
+                        let args =
+                            vec![ptr_operand.clone(), layout_operand, operation.expect_count()];
+                        (diagnostic, args)
+                    }
+                    _ => unreachable!(),
+                };
+                let is_ptr_initialized_instance = resolve_mem_init_fn(
+                    get_mem_init_fn_def(tcx, diagnostic, &mut self.mem_init_fn_cache),
+                    layout.len(),
+                    *pointee_info.ty(),
+                );
+                collect_skipped(&operation, body, skip_first);
+                body.add_call(
+                    &is_ptr_initialized_instance,
+                    source,
+                    operation.position(),
+                    args,
+                    ret_place.clone(),
+                );
+            }
+            PointeeLayout::Slice { element_layout } => {
+                // Since `str`` is a separate type, need to differentiate between [T] and str.
+                let (slicee_ty, diagnostic) = match pointee_info.ty().kind() {
+                    TyKind::RigidTy(RigidTy::Slice(slicee_ty)) => {
+                        (slicee_ty, "KaniIsSlicePtrInitialized")
+                    }
+                    TyKind::RigidTy(RigidTy::Str) => {
+                        (Ty::unsigned_ty(UintTy::U8), "KaniIsStrPtrInitialized")
+                    }
+                    _ => unreachable!(),
+                };
+                let is_ptr_initialized_instance = resolve_mem_init_fn(
+                    get_mem_init_fn_def(tcx, diagnostic, &mut self.mem_init_fn_cache),
+                    element_layout.len(),
+                    slicee_ty,
+                );
+                let layout_operand =
+                    mk_layout_operand(body, source, operation.position(), &element_layout);
+                collect_skipped(&operation, body, skip_first);
+                body.add_call(
+                    &is_ptr_initialized_instance,
+                    source,
+                    operation.position(),
+                    vec![ptr_operand.clone(), layout_operand],
+                    ret_place.clone(),
+                );
+            }
+            PointeeLayout::TraitObject => {
+                collect_skipped(&operation, body, skip_first);
+                let reason = "Kani does not support reasoning about memory initialization of pointers to trait objects.";
+                self.inject_assert_false(tcx, body, source, operation.position(), reason);
+                return;
+            }
+        };
+
+        // Make sure all non-padding bytes are initialized.
+        collect_skipped(&operation, body, skip_first);
+        let ptr_operand_ty = ptr_operand.ty(body.locals()).unwrap();
+        body.add_check(
+            tcx,
+            &self.check_type,
+            source,
+            operation.position(),
+            ret_place.local,
+            &format!("Undefined Behavior: Reading from an uninitialized pointer of type `{ptr_operand_ty}`"),
+        )
+    }
+
+    /// Inject a store into memory initialization state to initialize or deinitialize all
+    /// non-padding bytes.
+    fn build_set(
+        &mut self,
+        tcx: TyCtxt,
+        body: &mut MutableBody,
+        source: &mut SourceInstruction,
+        operation: MemoryInitOp,
+        pointee_info: PointeeInfo,
+        skip_first: &mut HashSet<usize>,
+    ) {
+        let ret_place = Place {
+            local: body.new_local(Ty::new_tuple(&[]), source.span(body.blocks()), Mutability::Not),
+            projection: vec![],
+        };
+        let ptr_operand = operation.mk_operand(body, source);
+        let value = operation.expect_value();
+
+        match pointee_info.layout() {
+            PointeeLayout::Sized { layout } => {
+                let layout_operand = mk_layout_operand(body, source, operation.position(), &layout);
+                // Depending on whether writing to the known number of elements in the slice, need to
+                // pass is as an argument.
+                let (diagnostic, args) = match &operation {
+                    MemoryInitOp::Set { .. } | MemoryInitOp::SetRef { .. } => {
+                        let diagnostic = "KaniSetPtrInitialized";
+                        let args = vec![
+                            ptr_operand,
+                            layout_operand,
+                            Operand::Constant(ConstOperand {
+                                span: source.span(body.blocks()),
+                                user_ty: None,
+                                const_: MirConst::from_bool(value),
+                            }),
+                        ];
+                        (diagnostic, args)
+                    }
+                    MemoryInitOp::SetSliceChunk { .. } => {
+                        let diagnostic = "KaniSetSliceChunkPtrInitialized";
+                        let args = vec![
+                            ptr_operand,
+                            layout_operand,
+                            operation.expect_count(),
+                            Operand::Constant(ConstOperand {
+                                span: source.span(body.blocks()),
+                                user_ty: None,
+                                const_: MirConst::from_bool(value),
+                            }),
+                        ];
+                        (diagnostic, args)
+                    }
+                    _ => unreachable!(),
+                };
+                let set_ptr_initialized_instance = resolve_mem_init_fn(
+                    get_mem_init_fn_def(tcx, diagnostic, &mut self.mem_init_fn_cache),
+                    layout.len(),
+                    *pointee_info.ty(),
+                );
+                collect_skipped(&operation, body, skip_first);
+                body.add_call(
+                    &set_ptr_initialized_instance,
+                    source,
+                    operation.position(),
+                    args,
+                    ret_place,
+                );
+            }
+            PointeeLayout::Slice { element_layout } => {
+                // Since `str`` is a separate type, need to differentiate between [T] and str.
+                let (slicee_ty, diagnostic) = match pointee_info.ty().kind() {
+                    TyKind::RigidTy(RigidTy::Slice(slicee_ty)) => {
+                        (slicee_ty, "KaniSetSlicePtrInitialized")
+                    }
+                    TyKind::RigidTy(RigidTy::Str) => {
+                        (Ty::unsigned_ty(UintTy::U8), "KaniSetStrPtrInitialized")
+                    }
+                    _ => unreachable!(),
+                };
+                let set_ptr_initialized_instance = resolve_mem_init_fn(
+                    get_mem_init_fn_def(tcx, diagnostic, &mut self.mem_init_fn_cache),
+                    element_layout.len(),
+                    slicee_ty,
+                );
+                let layout_operand =
+                    mk_layout_operand(body, source, operation.position(), &element_layout);
+                collect_skipped(&operation, body, skip_first);
+                body.add_call(
+                    &set_ptr_initialized_instance,
+                    source,
+                    operation.position(),
+                    vec![
+                        ptr_operand,
+                        layout_operand,
+                        Operand::Constant(ConstOperand {
+                            span: source.span(body.blocks()),
+                            user_ty: None,
+                            const_: MirConst::from_bool(value),
+                        }),
+                    ],
+                    ret_place,
+                );
+            }
+            PointeeLayout::TraitObject => {
+                unreachable!("Cannot change the initialization state of a trait object directly.");
+            }
+        };
+    }
+
+    fn inject_assert_false(
+        &self,
+        tcx: TyCtxt,
+        body: &mut MutableBody,
+        source: &mut SourceInstruction,
+        position: InsertPosition,
+        reason: &str,
+    ) {
+        let span = source.span(body.blocks());
+        let rvalue = Rvalue::Use(Operand::Constant(ConstOperand {
+            const_: MirConst::from_bool(false),
+            span,
+            user_ty: None,
+        }));
+        let result = body.new_assignment(rvalue, source, position);
+        body.add_check(tcx, &self.check_type, source, position, result, reason);
+    }
+}
+
+/// Create an operand from a bit array that represents a byte mask for a type layout where padding
+/// bytes are marked as `false` and data bytes are marked as `true`.
+///
+/// For example, the layout for:
+/// ```
+/// [repr(C)]
+/// struct {
+///     a: u16,
+///     b: u8
+/// }
+/// ```
+/// will have the following byte mask `[true, true, true, false]`.
+pub fn mk_layout_operand(
+    body: &mut MutableBody,
+    source: &mut SourceInstruction,
+    position: InsertPosition,
+    layout_byte_mask: &[bool],
+) -> Operand {
+    Operand::Move(Place {
+        local: body.new_assignment(
+            Rvalue::Aggregate(
+                AggregateKind::Array(Ty::bool_ty()),
+                layout_byte_mask
+                    .iter()
+                    .map(|byte| {
+                        Operand::Constant(ConstOperand {
+                            span: source.span(body.blocks()),
+                            user_ty: None,
+                            const_: MirConst::from_bool(*byte),
+                        })
+                    })
+                    .collect(),
+            ),
+            source,
+            position,
+        ),
+        projection: vec![],
+    })
+}
+
+/// If injecting a new call to the function before the current statement, need to skip the original
+/// statement when analyzing it as a part of the new basic block.
+fn collect_skipped(operation: &MemoryInitOp, body: &MutableBody, skip_first: &mut HashSet<usize>) {
+    if operation.position() == InsertPosition::Before {
+        let new_bb_idx = body.blocks().len();
+        skip_first.insert(new_bb_idx);
+    }
+}
+
+/// Retrieve a function definition by diagnostic string, caching the result.
+pub fn get_mem_init_fn_def(
+    tcx: TyCtxt,
+    diagnostic: &'static str,
+    cache: &mut HashMap<&'static str, FnDef>,
+) -> FnDef {
+    let entry = cache.entry(diagnostic).or_insert_with(|| find_fn_def(tcx, diagnostic).unwrap());
+    *entry
+}
+
+/// Resolves a given memory initialization function with passed type parameters.
+pub fn resolve_mem_init_fn(fn_def: FnDef, layout_size: usize, associated_type: Ty) -> Instance {
+    Instance::resolve(
+        fn_def,
+        &GenericArgs(vec![
+            GenericArgKind::Const(TyConst::try_from_target_usize(layout_size as u64).unwrap()),
+            GenericArgKind::Type(associated_type),
+        ]),
+    )
+    .unwrap()
+}
+
+/// Checks if the instance is a harness -- an entry point of Kani analysis.
+fn is_harness(instance: Instance, tcx: TyCtxt) -> bool {
+    let harness_identifiers = [
+        vec![
+            rustc_span::symbol::Symbol::intern("kanitool"),
+            rustc_span::symbol::Symbol::intern("proof_for_contract"),
+        ],
+        vec![
+            rustc_span::symbol::Symbol::intern("kanitool"),
+            rustc_span::symbol::Symbol::intern("proof"),
+        ],
+    ];
+    harness_identifiers.iter().any(|attr_path| {
+        tcx.has_attrs_with_path(rustc_internal::internal(tcx, instance.def.def_id()), attr_path)
+    })
+}
+
+/// Inject an initial call to set-up memory initialization tracking.
+fn inject_memory_init_setup(
+    new_body: &mut MutableBody,
+    tcx: TyCtxt,
+    mem_init_fn_cache: &mut HashMap<&'static str, FnDef>,
+) {
+    // First statement or terminator in the harness.
+    let mut source = if !new_body.blocks()[0].statements.is_empty() {
+        SourceInstruction::Statement { idx: 0, bb: 0 }
+    } else {
+        SourceInstruction::Terminator { bb: 0 }
+    };
+
+    // Dummy return place.
+    let ret_place = Place {
+        local: new_body.new_local(
+            Ty::new_tuple(&[]),
+            source.span(new_body.blocks()),
+            Mutability::Not,
+        ),
+        projection: vec![],
+    };
+
+    // Resolve the instance and inject a call to set-up the memory initialization state.
+    let memory_initialization_init = Instance::resolve(
+        get_mem_init_fn_def(tcx, "KaniInitializeMemoryInitializationState", mem_init_fn_cache),
+        &GenericArgs(vec![]),
+    )
+    .unwrap();
+
+    new_body.add_call(
+        &memory_initialization_init,
+        &mut source,
+        InsertPosition::Before,
+        vec![],
+        ret_place,
+    );
+}
diff --git a/kani-compiler/src/kani_middle/transform/check_uninit/ty_layout.rs b/kani-compiler/src/kani_middle/transform/check_uninit/ty_layout.rs
new file mode 100644
index 000000000000..09116230af80
--- /dev/null
+++ b/kani-compiler/src/kani_middle/transform/check_uninit/ty_layout.rs
@@ -0,0 +1,334 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+//
+//! Utility functions that help calculate type layout.
+
+use stable_mir::abi::{FieldsShape, Scalar, TagEncoding, ValueAbi, VariantsShape};
+use stable_mir::target::{MachineInfo, MachineSize};
+use stable_mir::ty::{AdtKind, IndexedVal, RigidTy, Ty, TyKind, UintTy};
+use stable_mir::CrateDef;
+
+/// Represents a chunk of data bytes in a data structure.
+#[derive(Clone, Debug, Eq, PartialEq, Hash)]
+struct DataBytes {
+    /// Offset in bytes.
+    offset: usize,
+    /// Size of this data chunk.
+    size: MachineSize,
+}
+
+/// Bytewise mask, representing which bytes of a type are data and which are padding. Here, `false`
+/// represents padding bytes and `true` represents data bytes.
+type Layout = Vec<bool>;
+
+/// Create a byte-wise mask from known chunks of data bytes.
+fn generate_byte_mask(size_in_bytes: usize, data_chunks: Vec<DataBytes>) -> Vec<bool> {
+    let mut layout_mask = vec![false; size_in_bytes];
+    for data_bytes in data_chunks.iter() {
+        for layout_item in
+            layout_mask.iter_mut().skip(data_bytes.offset).take(data_bytes.size.bytes())
+        {
+            *layout_item = true;
+        }
+    }
+    layout_mask
+}
+
+// Depending on whether the type is statically or dynamically sized,
+// the layout of the element or the layout of the actual type is returned.
+pub enum PointeeLayout {
+    /// Layout of sized objects.
+    Sized { layout: Layout },
+    /// Layout of slices, *const/mut str is included in this case and treated as *const/mut [u8].
+    Slice { element_layout: Layout },
+    /// Trait objects have an arbitrary layout.
+    TraitObject,
+}
+
+pub struct PointeeInfo {
+    pointee_ty: Ty,
+    layout: PointeeLayout,
+}
+
+impl PointeeInfo {
+    pub fn from_ty(ty: Ty) -> Result<Self, String> {
+        match ty.kind() {
+            TyKind::RigidTy(rigid_ty) => match rigid_ty {
+                RigidTy::Str => {
+                    let slicee_ty = Ty::unsigned_ty(UintTy::U8);
+                    let size_in_bytes = slicee_ty.layout().unwrap().shape().size.bytes();
+                    let data_chunks = data_bytes_for_ty(&MachineInfo::target(), slicee_ty, 0)?;
+                    let layout = PointeeLayout::Slice {
+                        element_layout: generate_byte_mask(size_in_bytes, data_chunks),
+                    };
+                    Ok(PointeeInfo { pointee_ty: ty, layout })
+                }
+                RigidTy::Slice(slicee_ty) => {
+                    let size_in_bytes = slicee_ty.layout().unwrap().shape().size.bytes();
+                    let data_chunks = data_bytes_for_ty(&MachineInfo::target(), slicee_ty, 0)?;
+                    let layout = PointeeLayout::Slice {
+                        element_layout: generate_byte_mask(size_in_bytes, data_chunks),
+                    };
+                    Ok(PointeeInfo { pointee_ty: ty, layout })
+                }
+                RigidTy::Dynamic(..) => {
+                    Ok(PointeeInfo { pointee_ty: ty, layout: PointeeLayout::TraitObject })
+                }
+                _ => {
+                    if ty.layout().unwrap().shape().is_sized() {
+                        let size_in_bytes = ty.layout().unwrap().shape().size.bytes();
+                        let data_chunks = data_bytes_for_ty(&MachineInfo::target(), ty, 0)?;
+                        let layout = PointeeLayout::Sized {
+                            layout: generate_byte_mask(size_in_bytes, data_chunks),
+                        };
+                        Ok(PointeeInfo { pointee_ty: ty, layout })
+                    } else {
+                        Err(format!("Cannot determine type layout for type `{ty}`"))
+                    }
+                }
+            },
+            TyKind::Alias(..) | TyKind::Param(..) | TyKind::Bound(..) => {
+                unreachable!("Should only encounter monomorphized types at this point.")
+            }
+        }
+    }
+
+    pub fn ty(&self) -> &Ty {
+        &self.pointee_ty
+    }
+
+    pub fn layout(&self) -> &PointeeLayout {
+        &self.layout
+    }
+}
+
+/// Retrieve a set of data bytes with offsets for a type.
+fn data_bytes_for_ty(
+    machine_info: &MachineInfo,
+    ty: Ty,
+    current_offset: usize,
+) -> Result<Vec<DataBytes>, String> {
+    let layout = ty.layout().unwrap().shape();
+
+    match layout.fields {
+        FieldsShape::Primitive => Ok(vec![match layout.abi {
+            ValueAbi::Scalar(Scalar::Initialized { value, .. }) => {
+                DataBytes { offset: current_offset, size: value.size(machine_info) }
+            }
+            _ => unreachable!("FieldsShape::Primitive with a different ABI than ValueAbi::Scalar"),
+        }]),
+        FieldsShape::Array { stride, count } if count > 0 => {
+            let TyKind::RigidTy(RigidTy::Array(elem_ty, _)) = ty.kind() else { unreachable!() };
+            let elem_data_bytes = data_bytes_for_ty(machine_info, elem_ty, current_offset)?;
+            let mut result = vec![];
+            if !elem_data_bytes.is_empty() {
+                for idx in 0..count {
+                    let idx: usize = idx.try_into().unwrap();
+                    let elem_offset = idx * stride.bytes();
+                    let mut next_data_bytes = elem_data_bytes
+                        .iter()
+                        .cloned()
+                        .map(|mut req| {
+                            req.offset += elem_offset;
+                            req
+                        })
+                        .collect::<Vec<_>>();
+                    result.append(&mut next_data_bytes)
+                }
+            }
+            Ok(result)
+        }
+        FieldsShape::Arbitrary { ref offsets } => {
+            match ty.kind().rigid().expect(&format!("unexpected type: {ty:?}")) {
+                RigidTy::Adt(def, args) => {
+                    match def.kind() {
+                        AdtKind::Enum => {
+                            // Support basic enumeration forms
+                            let ty_variants = def.variants();
+                            match layout.variants {
+                                VariantsShape::Single { index } => {
+                                    // Only one variant is reachable. This behaves like a struct.
+                                    let fields = ty_variants[index.to_index()].fields();
+                                    let mut fields_data_bytes = vec![];
+                                    for idx in layout.fields.fields_by_offset_order() {
+                                        let field_offset = offsets[idx].bytes();
+                                        let field_ty = fields[idx].ty_with_args(&args);
+                                        fields_data_bytes.append(&mut data_bytes_for_ty(
+                                            machine_info,
+                                            field_ty,
+                                            field_offset + current_offset,
+                                        )?);
+                                    }
+                                    Ok(fields_data_bytes)
+                                }
+                                VariantsShape::Multiple {
+                                    tag_encoding: TagEncoding::Niche { .. },
+                                    ..
+                                } => {
+                                    Err(format!("Unsupported Enum `{}` check", def.trimmed_name()))?
+                                }
+                                VariantsShape::Multiple { variants, tag, .. } => {
+                                    // Retrieve data bytes for the tag.
+                                    let tag_size = match tag {
+                                        Scalar::Initialized { value, .. } => {
+                                            value.size(&machine_info)
+                                        }
+                                        Scalar::Union { .. } => {
+                                            unreachable!("Enum tag should not be a union.")
+                                        }
+                                    };
+                                    // For enums, tag is the only field and should have offset of 0.
+                                    assert!(offsets.len() == 1 && offsets[0].bytes() == 0);
+                                    let tag_data_bytes =
+                                        vec![DataBytes { offset: current_offset, size: tag_size }];
+
+                                    // Retrieve data bytes for the fields.
+                                    let mut fields_data_bytes = vec![];
+                                    // Iterate over all variants for the enum.
+                                    for (index, variant) in variants.iter().enumerate() {
+                                        let mut field_data_bytes_for_variant = vec![];
+                                        let fields = ty_variants[index].fields();
+                                        // Get offsets of all fields in a variant.
+                                        let FieldsShape::Arbitrary { offsets: field_offsets } =
+                                            variant.fields.clone()
+                                        else {
+                                            unreachable!()
+                                        };
+                                        for field_idx in variant.fields.fields_by_offset_order() {
+                                            let field_offset = field_offsets[field_idx].bytes();
+                                            let field_ty = fields[field_idx].ty_with_args(&args);
+                                            field_data_bytes_for_variant.append(
+                                                &mut data_bytes_for_ty(
+                                                    machine_info,
+                                                    field_ty,
+                                                    field_offset + current_offset,
+                                                )?,
+                                            );
+                                        }
+                                        fields_data_bytes.push(field_data_bytes_for_variant);
+                                    }
+
+                                    if fields_data_bytes.is_empty() {
+                                        // If there are no fields, return the tag data bytes.
+                                        Ok(tag_data_bytes)
+                                    } else if fields_data_bytes.iter().all(
+                                        |data_bytes_for_variant| {
+                                            // Byte layout for variant N.
+                                            let byte_mask_for_variant = generate_byte_mask(
+                                                layout.size.bytes(),
+                                                data_bytes_for_variant.clone(),
+                                            );
+                                            // Byte layout for variant 0.
+                                            let byte_mask_for_first = generate_byte_mask(
+                                                layout.size.bytes(),
+                                                fields_data_bytes.first().unwrap().clone(),
+                                            );
+                                            byte_mask_for_variant == byte_mask_for_first
+                                        },
+                                    ) {
+                                        // If all fields have the same layout, return fields data
+                                        // bytes.
+                                        let mut total_data_bytes = tag_data_bytes;
+                                        let mut field_data_bytes =
+                                            fields_data_bytes.first().unwrap().clone();
+                                        total_data_bytes.append(&mut field_data_bytes);
+                                        Ok(total_data_bytes)
+                                    } else {
+                                        // Struct has multiple padding variants, Kani cannot
+                                        // differentiate between them.
+                                        Err(format!(
+                                            "Unsupported Enum `{}` check",
+                                            def.trimmed_name()
+                                        ))
+                                    }
+                                }
+                            }
+                        }
+                        AdtKind::Union => unreachable!(),
+                        AdtKind::Struct => {
+                            let mut struct_data_bytes = vec![];
+                            let fields = def.variants_iter().next().unwrap().fields();
+                            for idx in layout.fields.fields_by_offset_order() {
+                                let field_offset = offsets[idx].bytes();
+                                let field_ty = fields[idx].ty_with_args(&args);
+                                struct_data_bytes.append(&mut data_bytes_for_ty(
+                                    machine_info,
+                                    field_ty,
+                                    field_offset + current_offset,
+                                )?);
+                            }
+                            Ok(struct_data_bytes)
+                        }
+                    }
+                }
+                RigidTy::Pat(base_ty, ..) => {
+                    // This is similar to a structure with one field and with niche defined.
+                    let mut pat_data_bytes = vec![];
+                    pat_data_bytes.append(&mut data_bytes_for_ty(machine_info, *base_ty, 0)?);
+                    Ok(pat_data_bytes)
+                }
+                RigidTy::Tuple(tys) => {
+                    let mut tuple_data_bytes = vec![];
+                    for idx in layout.fields.fields_by_offset_order() {
+                        let field_offset = offsets[idx].bytes();
+                        let field_ty = tys[idx];
+                        tuple_data_bytes.append(&mut data_bytes_for_ty(
+                            machine_info,
+                            field_ty,
+                            field_offset + current_offset,
+                        )?);
+                    }
+                    Ok(tuple_data_bytes)
+                }
+                RigidTy::Bool
+                | RigidTy::Char
+                | RigidTy::Int(_)
+                | RigidTy::Uint(_)
+                | RigidTy::Float(_)
+                | RigidTy::Never => {
+                    unreachable!("Expected primitive layout for {ty:?}")
+                }
+                RigidTy::Str | RigidTy::Slice(_) | RigidTy::Array(_, _) => {
+                    unreachable!("Expected array layout for {ty:?}")
+                }
+                RigidTy::RawPtr(_, _) | RigidTy::Ref(_, _, _) => Ok(match layout.abi {
+                    ValueAbi::Scalar(Scalar::Initialized { value, .. }) => {
+                        // Thin pointer, ABI is a single scalar.
+                        vec![DataBytes { offset: current_offset, size: value.size(machine_info) }]
+                    }
+                    ValueAbi::ScalarPair(
+                        Scalar::Initialized { value: value_first, .. },
+                        Scalar::Initialized { value: value_second, .. },
+                    ) => {
+                        // Fat pointer, ABI is a scalar pair.
+                        let FieldsShape::Arbitrary { offsets } = layout.fields else {
+                            unreachable!()
+                        };
+                        // Since this is a scalar pair, only 2 elements are in the offsets vec.
+                        assert!(offsets.len() == 2);
+                        vec![
+                            DataBytes {
+                                offset: current_offset + offsets[0].bytes(),
+                                size: value_first.size(machine_info),
+                            },
+                            DataBytes {
+                                offset: current_offset + offsets[1].bytes(),
+                                size: value_second.size(machine_info),
+                            },
+                        ]
+                    }
+                    _ => unreachable!("RigidTy::RawPtr | RigidTy::Ref with a non-scalar ABI."),
+                }),
+                RigidTy::FnDef(_, _)
+                | RigidTy::FnPtr(_)
+                | RigidTy::Closure(_, _)
+                | RigidTy::Coroutine(_, _, _)
+                | RigidTy::CoroutineWitness(_, _)
+                | RigidTy::Foreign(_)
+                | RigidTy::Dynamic(_, _, _) => Err(format!("Unsupported {ty:?}")),
+            }
+        }
+        FieldsShape::Union(_) => Err(format!("Unsupported {ty:?}")),
+        FieldsShape::Array { .. } => Ok(vec![]),
+    }
+}
diff --git a/kani-compiler/src/kani_middle/transform/check_uninit/uninit_visitor.rs b/kani-compiler/src/kani_middle/transform/check_uninit/uninit_visitor.rs
new file mode 100644
index 000000000000..4c768aa2ee81
--- /dev/null
+++ b/kani-compiler/src/kani_middle/transform/check_uninit/uninit_visitor.rs
@@ -0,0 +1,808 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+//
+//! Visitor that collects all instructions relevant to uninitialized memory access.
+
+use crate::kani_middle::transform::body::{InsertPosition, MutableBody, SourceInstruction};
+use stable_mir::mir::alloc::GlobalAlloc;
+use stable_mir::mir::mono::{Instance, InstanceKind};
+use stable_mir::mir::visit::{Location, PlaceContext};
+use stable_mir::mir::{
+    BasicBlockIdx, CastKind, LocalDecl, MirVisitor, Mutability, NonDivergingIntrinsic, Operand,
+    Place, PointerCoercion, ProjectionElem, Rvalue, Statement, StatementKind, Terminator,
+    TerminatorKind,
+};
+use stable_mir::ty::{ConstantKind, RigidTy, Ty, TyKind};
+use strum_macros::AsRefStr;
+
+use super::{PointeeInfo, PointeeLayout};
+
+/// Memory initialization operations: set or get memory initialization state for a given pointer.
+#[derive(AsRefStr, Clone, Debug)]
+pub enum MemoryInitOp {
+    /// Check memory initialization of data bytes in a memory region starting from the pointer
+    /// `operand` and of length `sizeof(operand)` bytes.
+    Check { operand: Operand },
+    /// Set memory initialization state of data bytes in a memory region starting from the pointer
+    /// `operand` and of length `sizeof(operand)` bytes.
+    Set { operand: Operand, value: bool, position: InsertPosition },
+    /// Check memory initialization of data bytes in a memory region starting from the pointer
+    /// `operand` and of length `count * sizeof(operand)` bytes.
+    CheckSliceChunk { operand: Operand, count: Operand },
+    /// Set memory initialization state of data bytes in a memory region starting from the pointer
+    /// `operand` and of length `count * sizeof(operand)` bytes.
+    SetSliceChunk { operand: Operand, count: Operand, value: bool, position: InsertPosition },
+    /// Set memory initialization of data bytes in a memory region starting from the reference to
+    /// `operand` and of length `sizeof(operand)` bytes.
+    SetRef { operand: Operand, value: bool, position: InsertPosition },
+    /// Unsupported memory initialization operation.
+    Unsupported { reason: String },
+    /// Operation that trivially accesses uninitialized memory, results in injecting `assert!(false)`.
+    TriviallyUnsafe { reason: String },
+}
+
+impl MemoryInitOp {
+    /// Produce an operand for the relevant memory initialization related operation. This is mostly
+    /// required so that the analysis can create a new local to take a reference in
+    /// `MemoryInitOp::SetRef`.
+    pub fn mk_operand(&self, body: &mut MutableBody, source: &mut SourceInstruction) -> Operand {
+        match self {
+            MemoryInitOp::Check { operand, .. }
+            | MemoryInitOp::Set { operand, .. }
+            | MemoryInitOp::CheckSliceChunk { operand, .. }
+            | MemoryInitOp::SetSliceChunk { operand, .. } => operand.clone(),
+            MemoryInitOp::SetRef { operand, .. } => Operand::Copy(Place {
+                local: {
+                    let place = match operand {
+                        Operand::Copy(place) | Operand::Move(place) => place,
+                        Operand::Constant(_) => unreachable!(),
+                    };
+                    body.new_assignment(
+                        Rvalue::AddressOf(Mutability::Not, place.clone()),
+                        source,
+                        self.position(),
+                    )
+                },
+                projection: vec![],
+            }),
+            MemoryInitOp::Unsupported { .. } | MemoryInitOp::TriviallyUnsafe { .. } => {
+                unreachable!()
+            }
+        }
+    }
+
+    pub fn expect_count(&self) -> Operand {
+        match self {
+            MemoryInitOp::CheckSliceChunk { count, .. }
+            | MemoryInitOp::SetSliceChunk { count, .. } => count.clone(),
+            MemoryInitOp::Check { .. }
+            | MemoryInitOp::Set { .. }
+            | MemoryInitOp::SetRef { .. }
+            | MemoryInitOp::Unsupported { .. }
+            | MemoryInitOp::TriviallyUnsafe { .. } => unreachable!(),
+        }
+    }
+
+    pub fn expect_value(&self) -> bool {
+        match self {
+            MemoryInitOp::Set { value, .. }
+            | MemoryInitOp::SetSliceChunk { value, .. }
+            | MemoryInitOp::SetRef { value, .. } => *value,
+            MemoryInitOp::Check { .. }
+            | MemoryInitOp::CheckSliceChunk { .. }
+            | MemoryInitOp::Unsupported { .. }
+            | MemoryInitOp::TriviallyUnsafe { .. } => unreachable!(),
+        }
+    }
+
+    pub fn position(&self) -> InsertPosition {
+        match self {
+            MemoryInitOp::Set { position, .. }
+            | MemoryInitOp::SetSliceChunk { position, .. }
+            | MemoryInitOp::SetRef { position, .. } => *position,
+            MemoryInitOp::Check { .. }
+            | MemoryInitOp::CheckSliceChunk { .. }
+            | MemoryInitOp::Unsupported { .. }
+            | MemoryInitOp::TriviallyUnsafe { .. } => InsertPosition::Before,
+        }
+    }
+}
+
+/// Represents an instruction in the source code together with all memory initialization checks/sets
+/// that are connected to the memory used in this instruction and whether they should be inserted
+/// before or after the instruction.
+#[derive(Clone, Debug)]
+pub struct InitRelevantInstruction {
+    /// The instruction that affects the state of the memory.
+    pub source: SourceInstruction,
+    /// All memory-related operations that should happen after the instruction.
+    pub before_instruction: Vec<MemoryInitOp>,
+    /// All memory-related operations that should happen after the instruction.
+    pub after_instruction: Vec<MemoryInitOp>,
+}
+
+impl InitRelevantInstruction {
+    pub fn push_operation(&mut self, source_op: MemoryInitOp) {
+        match source_op.position() {
+            InsertPosition::Before => self.before_instruction.push(source_op),
+            InsertPosition::After => self.after_instruction.push(source_op),
+        }
+    }
+}
+
+pub struct CheckUninitVisitor<'a> {
+    locals: &'a [LocalDecl],
+    /// Whether we should skip the next instruction, since it might've been instrumented already.
+    /// When we instrument an instruction, we partition the basic block, and the instruction that
+    /// may trigger UB becomes the first instruction of the basic block, which we need to skip
+    /// later.
+    skip_next: bool,
+    /// The instruction being visited at a given point.
+    current: SourceInstruction,
+    /// The target instruction that should be verified.
+    pub target: Option<InitRelevantInstruction>,
+    /// The basic block being visited.
+    bb: BasicBlockIdx,
+}
+
+impl<'a> CheckUninitVisitor<'a> {
+    pub fn find_next(
+        body: &'a MutableBody,
+        bb: BasicBlockIdx,
+        skip_first: bool,
+    ) -> Option<InitRelevantInstruction> {
+        let mut visitor = CheckUninitVisitor {
+            locals: body.locals(),
+            skip_next: skip_first,
+            current: SourceInstruction::Statement { idx: 0, bb },
+            target: None,
+            bb,
+        };
+        visitor.visit_basic_block(&body.blocks()[bb]);
+        visitor.target
+    }
+
+    fn push_target(&mut self, source_op: MemoryInitOp) {
+        let target = self.target.get_or_insert_with(|| InitRelevantInstruction {
+            source: self.current,
+            after_instruction: vec![],
+            before_instruction: vec![],
+        });
+        target.push_operation(source_op);
+    }
+}
+
+impl<'a> MirVisitor for CheckUninitVisitor<'a> {
+    fn visit_statement(&mut self, stmt: &Statement, location: Location) {
+        if self.skip_next {
+            self.skip_next = false;
+        } else if self.target.is_none() {
+            // Leave it as an exhaustive match to be notified when a new kind is added.
+            match &stmt.kind {
+                StatementKind::Intrinsic(NonDivergingIntrinsic::CopyNonOverlapping(copy)) => {
+                    self.super_statement(stmt, location);
+                    // Source is a *const T and it must be initialized.
+                    self.push_target(MemoryInitOp::CheckSliceChunk {
+                        operand: copy.src.clone(),
+                        count: copy.count.clone(),
+                    });
+                    // Destimation is a *mut T so it gets initialized.
+                    self.push_target(MemoryInitOp::SetSliceChunk {
+                        operand: copy.dst.clone(),
+                        count: copy.count.clone(),
+                        value: true,
+                        position: InsertPosition::After,
+                    });
+                }
+                StatementKind::Assign(place, rvalue) => {
+                    // First check rvalue.
+                    self.visit_rvalue(rvalue, location);
+                    // Check whether we are assigning into a dereference (*ptr = _).
+                    if let Some(place_without_deref) = try_remove_topmost_deref(place) {
+                        // First, check that we are not dereferencing extra pointers along the way
+                        // (e.g., **ptr = _). If yes, check whether these pointers are initialized.
+                        let mut place_to_add_projections =
+                            Place { local: place_without_deref.local, projection: vec![] };
+                        for projection_elem in place_without_deref.projection.iter() {
+                            // If the projection is Deref and the current type is raw pointer, check
+                            // if it points to initialized memory.
+                            if *projection_elem == ProjectionElem::Deref {
+                                if let TyKind::RigidTy(RigidTy::RawPtr(..)) =
+                                    place_to_add_projections.ty(&self.locals).unwrap().kind()
+                                {
+                                    self.push_target(MemoryInitOp::Check {
+                                        operand: Operand::Copy(place_to_add_projections.clone()),
+                                    });
+                                };
+                            }
+                            place_to_add_projections.projection.push(projection_elem.clone());
+                        }
+                        if place_without_deref.ty(&self.locals).unwrap().kind().is_raw_ptr() {
+                            self.push_target(MemoryInitOp::Set {
+                                operand: Operand::Copy(place_without_deref),
+                                value: true,
+                                position: InsertPosition::After,
+                            });
+                        }
+                    }
+                    // Check whether Rvalue creates a new initialized pointer previously not captured inside shadow memory.
+                    if place.ty(&self.locals).unwrap().kind().is_raw_ptr() {
+                        if let Rvalue::AddressOf(..) = rvalue {
+                            self.push_target(MemoryInitOp::Set {
+                                operand: Operand::Copy(place.clone()),
+                                value: true,
+                                position: InsertPosition::After,
+                            });
+                        }
+                    }
+                }
+                StatementKind::Deinit(place) => {
+                    self.super_statement(stmt, location);
+                    self.push_target(MemoryInitOp::Set {
+                        operand: Operand::Copy(place.clone()),
+                        value: false,
+                        position: InsertPosition::After,
+                    });
+                }
+                StatementKind::FakeRead(_, _)
+                | StatementKind::SetDiscriminant { .. }
+                | StatementKind::StorageLive(_)
+                | StatementKind::StorageDead(_)
+                | StatementKind::Retag(_, _)
+                | StatementKind::PlaceMention(_)
+                | StatementKind::AscribeUserType { .. }
+                | StatementKind::Coverage(_)
+                | StatementKind::ConstEvalCounter
+                | StatementKind::Intrinsic(NonDivergingIntrinsic::Assume(_))
+                | StatementKind::Nop => self.super_statement(stmt, location),
+            }
+        }
+        let SourceInstruction::Statement { idx, bb } = self.current else { unreachable!() };
+        self.current = SourceInstruction::Statement { idx: idx + 1, bb };
+    }
+
+    fn visit_terminator(&mut self, term: &Terminator, location: Location) {
+        if !(self.skip_next || self.target.is_some()) {
+            self.current = SourceInstruction::Terminator { bb: self.bb };
+            // Leave it as an exhaustive match to be notified when a new kind is added.
+            match &term.kind {
+                TerminatorKind::Call { func, args, destination, .. } => {
+                    self.super_terminator(term, location);
+                    let instance = match try_resolve_instance(self.locals, func) {
+                        Ok(instance) => instance,
+                        Err(reason) => {
+                            self.super_terminator(term, location);
+                            self.push_target(MemoryInitOp::Unsupported { reason });
+                            return;
+                        }
+                    };
+                    match instance.kind {
+                        InstanceKind::Intrinsic => {
+                            match instance.intrinsic_name().unwrap().as_str() {
+                                intrinsic_name if can_skip_intrinsic(intrinsic_name) => {
+                                    /* Intrinsics that can be safely skipped */
+                                }
+                                name if name.starts_with("atomic") => {
+                                    let num_args = match name {
+                                        // All `atomic_cxchg` intrinsics take `dst, old, src` as arguments.
+                                        name if name.starts_with("atomic_cxchg") => 3,
+                                        // All `atomic_load` intrinsics take `src` as an argument.
+                                        name if name.starts_with("atomic_load") => 1,
+                                        // All other `atomic` intrinsics take `dst, src` as arguments.
+                                        _ => 2,
+                                    };
+                                    assert_eq!(
+                                        args.len(),
+                                        num_args,
+                                        "Unexpected number of arguments for `{name}`"
+                                    );
+                                    assert!(matches!(
+                                        args[0].ty(self.locals).unwrap().kind(),
+                                        TyKind::RigidTy(RigidTy::RawPtr(..))
+                                    ));
+                                    self.push_target(MemoryInitOp::Check {
+                                        operand: args[0].clone(),
+                                    });
+                                }
+                                "compare_bytes" => {
+                                    assert_eq!(
+                                        args.len(),
+                                        3,
+                                        "Unexpected number of arguments for `compare_bytes`"
+                                    );
+                                    assert!(matches!(
+                                        args[0].ty(self.locals).unwrap().kind(),
+                                        TyKind::RigidTy(RigidTy::RawPtr(_, Mutability::Not))
+                                    ));
+                                    assert!(matches!(
+                                        args[1].ty(self.locals).unwrap().kind(),
+                                        TyKind::RigidTy(RigidTy::RawPtr(_, Mutability::Not))
+                                    ));
+                                    self.push_target(MemoryInitOp::CheckSliceChunk {
+                                        operand: args[0].clone(),
+                                        count: args[2].clone(),
+                                    });
+                                    self.push_target(MemoryInitOp::CheckSliceChunk {
+                                        operand: args[1].clone(),
+                                        count: args[2].clone(),
+                                    });
+                                }
+                                "copy"
+                                | "volatile_copy_memory"
+                                | "volatile_copy_nonoverlapping_memory" => {
+                                    assert_eq!(
+                                        args.len(),
+                                        3,
+                                        "Unexpected number of arguments for `copy`"
+                                    );
+                                    assert!(matches!(
+                                        args[0].ty(self.locals).unwrap().kind(),
+                                        TyKind::RigidTy(RigidTy::RawPtr(_, Mutability::Not))
+                                    ));
+                                    assert!(matches!(
+                                        args[1].ty(self.locals).unwrap().kind(),
+                                        TyKind::RigidTy(RigidTy::RawPtr(_, Mutability::Mut))
+                                    ));
+                                    self.push_target(MemoryInitOp::CheckSliceChunk {
+                                        operand: args[0].clone(),
+                                        count: args[2].clone(),
+                                    });
+                                    self.push_target(MemoryInitOp::SetSliceChunk {
+                                        operand: args[1].clone(),
+                                        count: args[2].clone(),
+                                        value: true,
+                                        position: InsertPosition::After,
+                                    });
+                                }
+                                "typed_swap" => {
+                                    assert_eq!(
+                                        args.len(),
+                                        2,
+                                        "Unexpected number of arguments for `typed_swap`"
+                                    );
+                                    assert!(matches!(
+                                        args[0].ty(self.locals).unwrap().kind(),
+                                        TyKind::RigidTy(RigidTy::RawPtr(_, Mutability::Mut))
+                                    ));
+                                    assert!(matches!(
+                                        args[1].ty(self.locals).unwrap().kind(),
+                                        TyKind::RigidTy(RigidTy::RawPtr(_, Mutability::Mut))
+                                    ));
+                                    self.push_target(MemoryInitOp::Check {
+                                        operand: args[0].clone(),
+                                    });
+                                    self.push_target(MemoryInitOp::Check {
+                                        operand: args[1].clone(),
+                                    });
+                                }
+                                "volatile_load" | "unaligned_volatile_load" => {
+                                    assert_eq!(
+                                        args.len(),
+                                        1,
+                                        "Unexpected number of arguments for `volatile_load`"
+                                    );
+                                    assert!(matches!(
+                                        args[0].ty(self.locals).unwrap().kind(),
+                                        TyKind::RigidTy(RigidTy::RawPtr(_, Mutability::Not))
+                                    ));
+                                    self.push_target(MemoryInitOp::Check {
+                                        operand: args[0].clone(),
+                                    });
+                                }
+                                "volatile_store" => {
+                                    assert_eq!(
+                                        args.len(),
+                                        2,
+                                        "Unexpected number of arguments for `volatile_store`"
+                                    );
+                                    assert!(matches!(
+                                        args[0].ty(self.locals).unwrap().kind(),
+                                        TyKind::RigidTy(RigidTy::RawPtr(_, Mutability::Mut))
+                                    ));
+                                    self.push_target(MemoryInitOp::Set {
+                                        operand: args[0].clone(),
+                                        value: true,
+                                        position: InsertPosition::After,
+                                    });
+                                }
+                                "write_bytes" => {
+                                    assert_eq!(
+                                        args.len(),
+                                        3,
+                                        "Unexpected number of arguments for `write_bytes`"
+                                    );
+                                    assert!(matches!(
+                                        args[0].ty(self.locals).unwrap().kind(),
+                                        TyKind::RigidTy(RigidTy::RawPtr(_, Mutability::Mut))
+                                    ));
+                                    self.push_target(MemoryInitOp::SetSliceChunk {
+                                        operand: args[0].clone(),
+                                        count: args[2].clone(),
+                                        value: true,
+                                        position: InsertPosition::After,
+                                    })
+                                }
+                                intrinsic => {
+                                    self.push_target(MemoryInitOp::Unsupported {
+                                    reason: format!("Kani does not support reasoning about memory initialization of intrinsic `{intrinsic}`."),
+                                });
+                                }
+                            }
+                        }
+                        InstanceKind::Item => {
+                            if instance.is_foreign_item() {
+                                match instance.name().as_str() {
+                                    "alloc::alloc::__rust_alloc"
+                                    | "alloc::alloc::__rust_realloc" => {
+                                        /* Memory is uninitialized, nothing to do here. */
+                                    }
+                                    "alloc::alloc::__rust_alloc_zeroed" => {
+                                        /* Memory is initialized here, need to update shadow memory. */
+                                        self.push_target(MemoryInitOp::SetSliceChunk {
+                                            operand: Operand::Copy(destination.clone()),
+                                            count: args[0].clone(),
+                                            value: true,
+                                            position: InsertPosition::After,
+                                        });
+                                    }
+                                    "alloc::alloc::__rust_dealloc" => {
+                                        /* Memory is uninitialized here, need to update shadow memory. */
+                                        self.push_target(MemoryInitOp::SetSliceChunk {
+                                            operand: args[0].clone(),
+                                            count: args[1].clone(),
+                                            value: false,
+                                            position: InsertPosition::After,
+                                        });
+                                    }
+                                    _ => {}
+                                }
+                            }
+                        }
+                        _ => {}
+                    }
+                }
+                TerminatorKind::Drop { place, .. } => {
+                    self.super_terminator(term, location);
+                    let place_ty = place.ty(&self.locals).unwrap();
+
+                    // When drop is codegen'ed for types that could define their own dropping
+                    // behavior, a reference is taken to the place which is later implicitly coerced
+                    // to a pointer. Hence, we need to bless this pointer as initialized.
+                    match place
+                        .ty(&self.locals)
+                        .unwrap()
+                        .kind()
+                        .rigid()
+                        .expect("should be working with monomorphized code")
+                    {
+                        RigidTy::Adt(..) | RigidTy::Dynamic(_, _, _) => {
+                            self.push_target(MemoryInitOp::SetRef {
+                                operand: Operand::Copy(place.clone()),
+                                value: true,
+                                position: InsertPosition::Before,
+                            });
+                        }
+                        _ => {}
+                    }
+
+                    if place_ty.kind().is_raw_ptr() {
+                        self.push_target(MemoryInitOp::Set {
+                            operand: Operand::Copy(place.clone()),
+                            value: false,
+                            position: InsertPosition::After,
+                        });
+                    }
+                }
+                TerminatorKind::Goto { .. }
+                | TerminatorKind::SwitchInt { .. }
+                | TerminatorKind::Resume
+                | TerminatorKind::Abort
+                | TerminatorKind::Return
+                | TerminatorKind::Unreachable
+                | TerminatorKind::Assert { .. }
+                | TerminatorKind::InlineAsm { .. } => self.super_terminator(term, location),
+            }
+        }
+    }
+
+    fn visit_place(&mut self, place: &Place, ptx: PlaceContext, location: Location) {
+        for (idx, elem) in place.projection.iter().enumerate() {
+            let intermediate_place =
+                Place { local: place.local, projection: place.projection[..idx].to_vec() };
+            match elem {
+                ProjectionElem::Deref => {
+                    let ptr_ty = intermediate_place.ty(self.locals).unwrap();
+                    if ptr_ty.kind().is_raw_ptr() {
+                        self.push_target(MemoryInitOp::Check {
+                            operand: Operand::Copy(intermediate_place.clone()),
+                        });
+                    }
+                }
+                ProjectionElem::Field(idx, target_ty) => {
+                    if target_ty.kind().is_union()
+                        && (!ptx.is_mutating() || place.projection.len() > idx + 1)
+                    {
+                        self.push_target(MemoryInitOp::Unsupported {
+                            reason: "Kani does not support reasoning about memory initialization of unions.".to_string(),
+                        });
+                    }
+                }
+                ProjectionElem::Index(_)
+                | ProjectionElem::ConstantIndex { .. }
+                | ProjectionElem::Subslice { .. } => {
+                    /* For a slice to be indexed, it should be valid first. */
+                }
+                ProjectionElem::Downcast(_) => {}
+                ProjectionElem::OpaqueCast(_) => {}
+                ProjectionElem::Subtype(_) => {}
+            }
+        }
+        self.super_place(place, ptx, location)
+    }
+
+    fn visit_operand(&mut self, operand: &Operand, location: Location) {
+        if let Operand::Constant(constant) = operand {
+            if let ConstantKind::Allocated(allocation) = constant.const_.kind() {
+                for (_, prov) in &allocation.provenance.ptrs {
+                    if let GlobalAlloc::Static(_) = GlobalAlloc::from(prov.0) {
+                        if constant.ty().kind().is_raw_ptr() {
+                            // If a static is a raw pointer, need to mark it as initialized.
+                            self.push_target(MemoryInitOp::Set {
+                                operand: Operand::Constant(constant.clone()),
+                                value: true,
+                                position: InsertPosition::Before,
+                            });
+                        }
+                    };
+                }
+            }
+        }
+        self.super_operand(operand, location);
+    }
+
+    fn visit_rvalue(&mut self, rvalue: &Rvalue, location: Location) {
+        if let Rvalue::Cast(cast_kind, operand, ty) = rvalue {
+            match cast_kind {
+                CastKind::PointerCoercion(PointerCoercion::Unsize) => {
+                    if let TyKind::RigidTy(RigidTy::RawPtr(pointee_ty, _)) = ty.kind() {
+                        if pointee_ty.kind().is_trait() {
+                            self.push_target(MemoryInitOp::Unsupported {
+                                reason: "Kani does not support reasoning about memory initialization of unsized pointers.".to_string(),
+                            });
+                        }
+                    }
+                }
+                CastKind::PtrToPtr => {
+                    let operand_ty = operand.ty(&self.locals).unwrap();
+                    if let (
+                        RigidTy::RawPtr(from_ty, Mutability::Mut),
+                        RigidTy::RawPtr(to_ty, Mutability::Mut),
+                    ) = (operand_ty.kind().rigid().unwrap(), ty.kind().rigid().unwrap())
+                    {
+                        if !tys_layout_compatible(from_ty, to_ty) {
+                            // If casting from a mutable pointer to a mutable pointer with
+                            // different layouts, delayed UB could occur.
+                            self.push_target(MemoryInitOp::Unsupported {
+                                reason: "Kani does not support reasoning about memory initialization in presence of mutable raw pointer casts that could cause delayed UB.".to_string(),
+                            });
+                        }
+                    }
+                }
+                CastKind::Transmute => {
+                    let operand_ty = operand.ty(&self.locals).unwrap();
+                    if let (
+                        RigidTy::RawPtr(from_ty, Mutability::Mut),
+                        RigidTy::RawPtr(to_ty, Mutability::Mut),
+                    ) = (operand_ty.kind().rigid().unwrap(), ty.kind().rigid().unwrap())
+                    {
+                        if !tys_layout_compatible(from_ty, to_ty) {
+                            // If casting from a mutable pointer to a mutable pointer with different
+                            // layouts, delayed UB could occur.
+                            self.push_target(MemoryInitOp::Unsupported {
+                                reason: "Kani does not support reasoning about memory initialization in presence of mutable raw pointer casts that could cause delayed UB.".to_string(),
+                            });
+                        }
+                    } else if !tys_layout_compatible(&operand_ty, &ty) {
+                        // If transmuting between two types of incompatible layouts, padding
+                        // bytes are exposed, which is UB.
+                        self.push_target(MemoryInitOp::TriviallyUnsafe {
+                            reason: "Transmuting between types of incompatible layouts."
+                                .to_string(),
+                        });
+                    }
+                }
+                _ => {}
+            }
+        };
+        self.super_rvalue(rvalue, location);
+    }
+}
+
+/// Determines if the intrinsic has no memory initialization related function and hence can be
+/// safely skipped.
+fn can_skip_intrinsic(intrinsic_name: &str) -> bool {
+    match intrinsic_name {
+        "add_with_overflow"
+        | "arith_offset"
+        | "assert_inhabited"
+        | "assert_mem_uninitialized_valid"
+        | "assert_zero_valid"
+        | "assume"
+        | "bitreverse"
+        | "black_box"
+        | "breakpoint"
+        | "bswap"
+        | "caller_location"
+        | "ceilf32"
+        | "ceilf64"
+        | "copysignf32"
+        | "copysignf64"
+        | "cosf32"
+        | "cosf64"
+        | "ctlz"
+        | "ctlz_nonzero"
+        | "ctpop"
+        | "cttz"
+        | "cttz_nonzero"
+        | "discriminant_value"
+        | "exact_div"
+        | "exp2f32"
+        | "exp2f64"
+        | "expf32"
+        | "expf64"
+        | "fabsf32"
+        | "fabsf64"
+        | "fadd_fast"
+        | "fdiv_fast"
+        | "floorf32"
+        | "floorf64"
+        | "fmaf32"
+        | "fmaf64"
+        | "fmul_fast"
+        | "forget"
+        | "fsub_fast"
+        | "is_val_statically_known"
+        | "likely"
+        | "log10f32"
+        | "log10f64"
+        | "log2f32"
+        | "log2f64"
+        | "logf32"
+        | "logf64"
+        | "maxnumf32"
+        | "maxnumf64"
+        | "min_align_of"
+        | "min_align_of_val"
+        | "minnumf32"
+        | "minnumf64"
+        | "mul_with_overflow"
+        | "nearbyintf32"
+        | "nearbyintf64"
+        | "needs_drop"
+        | "powf32"
+        | "powf64"
+        | "powif32"
+        | "powif64"
+        | "pref_align_of"
+        | "raw_eq"
+        | "rintf32"
+        | "rintf64"
+        | "rotate_left"
+        | "rotate_right"
+        | "roundf32"
+        | "roundf64"
+        | "saturating_add"
+        | "saturating_sub"
+        | "sinf32"
+        | "sinf64"
+        | "sqrtf32"
+        | "sqrtf64"
+        | "sub_with_overflow"
+        | "truncf32"
+        | "truncf64"
+        | "type_id"
+        | "type_name"
+        | "unchecked_div"
+        | "unchecked_rem"
+        | "unlikely"
+        | "vtable_size"
+        | "vtable_align"
+        | "wrapping_add"
+        | "wrapping_mul"
+        | "wrapping_sub" => {
+            /* Intrinsics that do not interact with memory initialization. */
+            true
+        }
+        "ptr_guaranteed_cmp" | "ptr_offset_from" | "ptr_offset_from_unsigned" | "size_of_val" => {
+            /* AFAICS from the documentation, none of those require the pointer arguments to be actually initialized. */
+            true
+        }
+        name if name.starts_with("simd") => {
+            /* SIMD operations */
+            true
+        }
+        name if name.starts_with("atomic_fence")
+            || name.starts_with("atomic_singlethreadfence") =>
+        {
+            /* Atomic fences */
+            true
+        }
+        "copy_nonoverlapping" => unreachable!(
+            "Expected `core::intrinsics::unreachable` to be handled by `StatementKind::CopyNonOverlapping`"
+        ),
+        "offset" => unreachable!(
+            "Expected `core::intrinsics::unreachable` to be handled by `BinOp::OffSet`"
+        ),
+        "unreachable" => unreachable!(
+            "Expected `std::intrinsics::unreachable` to be handled by `TerminatorKind::Unreachable`"
+        ),
+        "transmute" | "transmute_copy" | "unchecked_add" | "unchecked_mul" | "unchecked_shl"
+        | "size_of" | "unchecked_shr" | "unchecked_sub" => {
+            unreachable!("Expected intrinsic to be lowered before codegen")
+        }
+        "catch_unwind" => {
+            unimplemented!("")
+        }
+        "retag_box_to_raw" => {
+            unreachable!("This was removed in the latest Rust version.")
+        }
+        _ => {
+            /* Everything else */
+            false
+        }
+    }
+}
+
+/// Try removing a topmost deref projection from a place if it exists, returning a place without it.
+fn try_remove_topmost_deref(place: &Place) -> Option<Place> {
+    let mut new_place = place.clone();
+    if let Some(ProjectionElem::Deref) = new_place.projection.pop() {
+        Some(new_place)
+    } else {
+        None
+    }
+}
+
+/// Try retrieving instance for the given function operand.
+fn try_resolve_instance(locals: &[LocalDecl], func: &Operand) -> Result<Instance, String> {
+    let ty = func.ty(locals).unwrap();
+    match ty.kind() {
+        TyKind::RigidTy(RigidTy::FnDef(def, args)) => Ok(Instance::resolve(def, &args).unwrap()),
+        _ => Err(format!(
+            "Kani does not support reasoning about memory initialization of arguments to `{ty:?}`."
+        )),
+    }
+}
+
+/// Returns true if `to_ty` has a smaller or equal size and the same padding bytes as `from_ty` up until
+/// its size.
+fn tys_layout_compatible(from_ty: &Ty, to_ty: &Ty) -> bool {
+    // Retrieve layouts to assess compatibility.
+    let from_ty_info = PointeeInfo::from_ty(*from_ty);
+    let to_ty_info = PointeeInfo::from_ty(*to_ty);
+    if let (Ok(from_ty_info), Ok(to_ty_info)) = (from_ty_info, to_ty_info) {
+        let from_ty_layout = match from_ty_info.layout() {
+            PointeeLayout::Sized { layout } => layout,
+            PointeeLayout::Slice { element_layout } => element_layout,
+            PointeeLayout::TraitObject => return false,
+        };
+        let to_ty_layout = match to_ty_info.layout() {
+            PointeeLayout::Sized { layout } => layout,
+            PointeeLayout::Slice { element_layout } => element_layout,
+            PointeeLayout::TraitObject => return false,
+        };
+        // Ensure `to_ty_layout` does not have a larger size.
+        if to_ty_layout.len() <= from_ty_layout.len() {
+            // Check data and padding bytes pair-wise.
+            if from_ty_layout.iter().zip(to_ty_layout.iter()).all(
+                |(from_ty_layout_byte, to_ty_layout_byte)| {
+                    // Make sure all data and padding bytes match.
+                    from_ty_layout_byte == to_ty_layout_byte
+                },
+            ) {
+                return true;
+            }
+        }
+    };
+    false
+}
diff --git a/kani-compiler/src/kani_middle/transform/check_values.rs b/kani-compiler/src/kani_middle/transform/check_values.rs
index 4ecb16fab023..a7d0f14d270f 100644
--- a/kani-compiler/src/kani_middle/transform/check_values.rs
+++ b/kani-compiler/src/kani_middle/transform/check_values.rs
@@ -14,7 +14,9 @@
 //!   1. We could merge the invalid values by the offset.
 //!   2. We could avoid checking places that have been checked before.
 use crate::args::ExtraChecks;
-use crate::kani_middle::transform::body::{CheckType, MutableBody, SourceInstruction};
+use crate::kani_middle::transform::body::{
+    CheckType, InsertPosition, MutableBody, SourceInstruction,
+};
 use crate::kani_middle::transform::check_values::SourceOp::UnsupportedCheck;
 use crate::kani_middle::transform::{TransformPass, TransformationType};
 use crate::kani_queries::QueryDb;
@@ -59,7 +61,7 @@ impl TransformPass for ValidValuePass {
 
     /// Transform the function body by inserting checks one-by-one.
     /// For every unsafe dereference or a transmute operation, we check all values are valid.
-    fn transform(&self, tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body) {
+    fn transform(&mut self, tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body) {
         trace!(function=?instance.name(), "transform");
         let mut new_body = MutableBody::from(body);
         let orig_len = new_body.blocks().len();
@@ -83,13 +85,20 @@ impl ValidValuePass {
         for operation in instruction.operations {
             match operation {
                 SourceOp::BytesValidity { ranges, target_ty, rvalue } => {
-                    let value = body.new_assignment(rvalue, &mut source);
+                    let value = body.new_assignment(rvalue, &mut source, InsertPosition::Before);
                     let rvalue_ptr = Rvalue::AddressOf(Mutability::Not, Place::from(value));
                     for range in ranges {
                         let result = build_limits(body, &range, rvalue_ptr.clone(), &mut source);
                         let msg =
                             format!("Undefined Behavior: Invalid value of type `{target_ty}`",);
-                        body.add_check(tcx, &self.check_type, &mut source, result, &msg);
+                        body.add_check(
+                            tcx,
+                            &self.check_type,
+                            &mut source,
+                            InsertPosition::Before,
+                            result,
+                            &msg,
+                        );
                     }
                 }
                 SourceOp::DerefValidity { pointee_ty, rvalue, ranges } => {
@@ -97,7 +106,14 @@ impl ValidValuePass {
                         let result = build_limits(body, &range, rvalue.clone(), &mut source);
                         let msg =
                             format!("Undefined Behavior: Invalid value of type `{pointee_ty}`",);
-                        body.add_check(tcx, &self.check_type, &mut source, result, &msg);
+                        body.add_check(
+                            tcx,
+                            &self.check_type,
+                            &mut source,
+                            InsertPosition::Before,
+                            result,
+                            &msg,
+                        );
                     }
                 }
                 SourceOp::UnsupportedCheck { check, ty } => {
@@ -123,8 +139,8 @@ impl ValidValuePass {
             span,
             user_ty: None,
         }));
-        let result = body.new_assignment(rvalue, source);
-        body.add_check(tcx, &self.check_type, source, result, reason);
+        let result = body.new_assignment(rvalue, source, InsertPosition::Before);
+        body.add_check(tcx, &self.check_type, source, InsertPosition::Before, result, reason);
     }
 }
 
@@ -758,30 +774,60 @@ pub fn build_limits(
     let start_const = body.new_const_operand(req.valid_range.start, primitive_ty, span);
     let end_const = body.new_const_operand(req.valid_range.end, primitive_ty, span);
     let orig_ptr = if req.offset != 0 {
-        let start_ptr = move_local(body.new_assignment(rvalue_ptr, source));
+        let start_ptr = move_local(body.new_assignment(rvalue_ptr, source, InsertPosition::Before));
         let byte_ptr = move_local(body.new_cast_ptr(
             start_ptr,
             Ty::unsigned_ty(UintTy::U8),
             Mutability::Not,
             source,
+            InsertPosition::Before,
         ));
         let offset_const = body.new_const_operand(req.offset as _, UintTy::Usize, span);
-        let offset = move_local(body.new_assignment(Rvalue::Use(offset_const), source));
-        move_local(body.new_binary_op(BinOp::Offset, byte_ptr, offset, source))
+        let offset = move_local(body.new_assignment(
+            Rvalue::Use(offset_const),
+            source,
+            InsertPosition::Before,
+        ));
+        move_local(body.new_binary_op(
+            BinOp::Offset,
+            byte_ptr,
+            offset,
+            source,
+            InsertPosition::Before,
+        ))
     } else {
-        move_local(body.new_assignment(rvalue_ptr, source))
+        move_local(body.new_assignment(rvalue_ptr, source, InsertPosition::Before))
     };
-    let value_ptr =
-        body.new_cast_ptr(orig_ptr, Ty::unsigned_ty(primitive_ty), Mutability::Not, source);
+    let value_ptr = body.new_cast_ptr(
+        orig_ptr,
+        Ty::unsigned_ty(primitive_ty),
+        Mutability::Not,
+        source,
+        InsertPosition::Before,
+    );
     let value = Operand::Copy(Place { local: value_ptr, projection: vec![ProjectionElem::Deref] });
-    let start_result = body.new_binary_op(BinOp::Ge, value.clone(), start_const, source);
-    let end_result = body.new_binary_op(BinOp::Le, value, end_const, source);
+    let start_result =
+        body.new_binary_op(BinOp::Ge, value.clone(), start_const, source, InsertPosition::Before);
+    let end_result =
+        body.new_binary_op(BinOp::Le, value, end_const, source, InsertPosition::Before);
     if req.valid_range.wraps_around() {
         // valid >= start || valid <= end
-        body.new_binary_op(BinOp::BitOr, move_local(start_result), move_local(end_result), source)
+        body.new_binary_op(
+            BinOp::BitOr,
+            move_local(start_result),
+            move_local(end_result),
+            source,
+            InsertPosition::Before,
+        )
     } else {
         // valid >= start && valid <= end
-        body.new_binary_op(BinOp::BitAnd, move_local(start_result), move_local(end_result), source)
+        body.new_binary_op(
+            BinOp::BitAnd,
+            move_local(start_result),
+            move_local(end_result),
+            source,
+            InsertPosition::Before,
+        )
     }
 }
 
diff --git a/kani-compiler/src/kani_middle/transform/contracts.rs b/kani-compiler/src/kani_middle/transform/contracts.rs
index f5760bd4d829..3a835c7f3cb6 100644
--- a/kani-compiler/src/kani_middle/transform/contracts.rs
+++ b/kani-compiler/src/kani_middle/transform/contracts.rs
@@ -11,20 +11,29 @@ use rustc_middle::ty::TyCtxt;
 use rustc_smir::rustc_internal;
 use stable_mir::mir::mono::Instance;
 use stable_mir::mir::{Body, ConstOperand, Operand, TerminatorKind};
-use stable_mir::ty::{FnDef, MirConst, RigidTy, TyKind};
+use stable_mir::ty::{FnDef, MirConst, RigidTy, TyKind, TypeAndMut};
 use stable_mir::{CrateDef, DefId};
 use std::collections::HashSet;
 use std::fmt::Debug;
 use tracing::{debug, trace};
 
-/// Check if we can replace calls to any_modifies.
+/// Check if we can replace calls to any_modifies or write_any.
 ///
 /// This pass will replace the entire body, and it should only be applied to stubs
 /// that have a body.
+///
+/// write_any is replaced with one of write_any_slim, write_any_slice, or write_any_str
+/// depending on what the type of the input it
+///
+/// any_modifies is replaced with any
 #[derive(Debug)]
 pub struct AnyModifiesPass {
     kani_any: Option<FnDef>,
     kani_any_modifies: Option<FnDef>,
+    kani_write_any: Option<FnDef>,
+    kani_write_any_slim: Option<FnDef>,
+    kani_write_any_slice: Option<FnDef>,
+    kani_write_any_str: Option<FnDef>,
     stubbed: HashSet<DefId>,
     target_fn: Option<InternedString>,
 }
@@ -47,7 +56,7 @@ impl TransformPass for AnyModifiesPass {
     }
 
     /// Transform the function body by replacing it with the stub body.
-    fn transform(&self, tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body) {
+    fn transform(&mut self, tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body) {
         trace!(function=?instance.name(), "AnyModifiesPass::transform");
 
         if instance.def.def_id() == self.kani_any.unwrap().def_id() {
@@ -78,6 +87,18 @@ impl AnyModifiesPass {
         let kani_any_modifies = tcx
             .get_diagnostic_item(rustc_span::symbol::Symbol::intern("KaniAnyModifies"))
             .map(item_fn_def);
+        let kani_write_any = tcx
+            .get_diagnostic_item(rustc_span::symbol::Symbol::intern("KaniWriteAny"))
+            .map(item_fn_def);
+        let kani_write_any_slim = tcx
+            .get_diagnostic_item(rustc_span::symbol::Symbol::intern("KaniWriteAnySlim"))
+            .map(item_fn_def);
+        let kani_write_any_slice = tcx
+            .get_diagnostic_item(rustc_span::symbol::Symbol::intern("KaniWriteAnySlice"))
+            .map(item_fn_def);
+        let kani_write_any_str = tcx
+            .get_diagnostic_item(rustc_span::symbol::Symbol::intern("KaniWriteAnyStr"))
+            .map(item_fn_def);
         let (target_fn, stubbed) = if let Some(harness) = unit.harnesses.first() {
             let attributes = KaniAttributes::for_instance(tcx, *harness);
             let target_fn =
@@ -86,7 +107,16 @@ impl AnyModifiesPass {
         } else {
             (None, HashSet::new())
         };
-        AnyModifiesPass { kani_any, kani_any_modifies, target_fn, stubbed }
+        AnyModifiesPass {
+            kani_any,
+            kani_any_modifies,
+            kani_write_any,
+            kani_write_any_slim,
+            kani_write_any_slice,
+            kani_write_any_str,
+            target_fn,
+            stubbed,
+        }
     }
 
     /// If we apply `transform_any_modifies` in all contract-generated items,
@@ -105,7 +135,7 @@ impl AnyModifiesPass {
         let mut changed = false;
         let locals = body.locals().to_vec();
         for bb in body.blocks.iter_mut() {
-            let TerminatorKind::Call { func, .. } = &mut bb.terminator.kind else { continue };
+            let TerminatorKind::Call { func, args, .. } = &mut bb.terminator.kind else { continue };
             if let TyKind::RigidTy(RigidTy::FnDef(def, instance_args)) =
                 func.ty(&locals).unwrap().kind()
                 && Some(def) == self.kani_any_modifies
@@ -117,6 +147,47 @@ impl AnyModifiesPass {
                 *func = Operand::Constant(new_func);
                 changed = true;
             }
+
+            // if this is a valid kani::write_any function
+            if let TyKind::RigidTy(RigidTy::FnDef(def, instance_args)) =
+                func.ty(&locals).unwrap().kind()
+                && Some(def) == self.kani_write_any
+                && args.len() == 1
+                && let Some(fn_sig) = func.ty(&locals).unwrap().kind().fn_sig()
+                && let Some(TypeAndMut { ty: internal_type, mutability: _ }) =
+                    fn_sig.skip_binder().inputs()[0].kind().builtin_deref(true)
+            {
+                // case on the type of the input
+                if let TyKind::RigidTy(RigidTy::Slice(_)) = internal_type.kind() {
+                    //if the input is a slice, use write_any_slice
+                    let instance =
+                        Instance::resolve(self.kani_write_any_slice.unwrap(), &instance_args)
+                            .unwrap();
+                    let literal = MirConst::try_new_zero_sized(instance.ty()).unwrap();
+                    let span = bb.terminator.span;
+                    let new_func = ConstOperand { span, user_ty: None, const_: literal };
+                    *func = Operand::Constant(new_func);
+                } else if let TyKind::RigidTy(RigidTy::Str) = internal_type.kind() {
+                    //if the input is a str, use write_any_str
+                    let instance =
+                        Instance::resolve(self.kani_write_any_str.unwrap(), &instance_args)
+                            .unwrap();
+                    let literal = MirConst::try_new_zero_sized(instance.ty()).unwrap();
+                    let span = bb.terminator.span;
+                    let new_func = ConstOperand { span, user_ty: None, const_: literal };
+                    *func = Operand::Constant(new_func);
+                } else {
+                    //otherwise, use write_any_slim
+                    let instance =
+                        Instance::resolve(self.kani_write_any_slim.unwrap(), &instance_args)
+                            .unwrap();
+                    let literal = MirConst::try_new_zero_sized(instance.ty()).unwrap();
+                    let span = bb.terminator.span;
+                    let new_func = ConstOperand { span, user_ty: None, const_: literal };
+                    *func = Operand::Constant(new_func);
+                }
+                changed = true;
+            }
         }
         (changed, body)
     }
diff --git a/kani-compiler/src/kani_middle/transform/dump_mir_pass.rs b/kani-compiler/src/kani_middle/transform/dump_mir_pass.rs
new file mode 100644
index 000000000000..9393ec0d88c9
--- /dev/null
+++ b/kani-compiler/src/kani_middle/transform/dump_mir_pass.rs
@@ -0,0 +1,69 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Global transformation pass, which does not modify bodies but dumps MIR whenever the appropriate debug flag is passed.
+
+use crate::kani_middle::reachability::CallGraph;
+use crate::kani_middle::transform::GlobalPass;
+use crate::kani_queries::QueryDb;
+use kani_metadata::ArtifactType;
+use rustc_middle::ty::TyCtxt;
+use rustc_session::config::OutputType;
+use stable_mir::mir::mono::{Instance, MonoItem};
+use std::fs::File;
+use std::io::BufWriter;
+use std::io::Write;
+
+use super::BodyTransformation;
+
+/// Dump all MIR bodies.
+#[derive(Debug)]
+pub struct DumpMirPass {
+    enabled: bool,
+}
+
+impl DumpMirPass {
+    pub fn new(tcx: TyCtxt) -> Self {
+        Self { enabled: tcx.sess.opts.output_types.contains_key(&OutputType::Mir) }
+    }
+}
+
+impl GlobalPass for DumpMirPass {
+    fn is_enabled(&self, _query_db: &QueryDb) -> bool {
+        self.enabled
+    }
+
+    fn transform(
+        &mut self,
+        tcx: TyCtxt,
+        _call_graph: &CallGraph,
+        starting_items: &[MonoItem],
+        instances: Vec<Instance>,
+        transformer: &mut BodyTransformation,
+    ) {
+        // Create output buffer.
+        let file_path = {
+            let base_path = tcx.output_filenames(()).path(OutputType::Object);
+            let base_name = base_path.as_path();
+            let entry_point = (starting_items.len() == 1).then_some(starting_items[0].clone());
+            // If there is a single entry point, use it as a file name.
+            if let Some(MonoItem::Fn(starting_instance)) = entry_point {
+                let mangled_name = starting_instance.mangled_name();
+                let file_stem =
+                    format!("{}_{mangled_name}", base_name.file_stem().unwrap().to_str().unwrap());
+                base_name.with_file_name(file_stem).with_extension(ArtifactType::SymTabGoto)
+            } else {
+                // Otherwise, use the object output path from the compiler.
+                base_name.with_extension(ArtifactType::SymTabGoto)
+            }
+        };
+        let out_file = File::create(file_path.with_extension("kani.mir")).unwrap();
+        let mut writer = BufWriter::new(out_file);
+
+        // For each def_id, dump their MIR.
+        for instance in instances.iter() {
+            writeln!(writer, "// Item: {} ({})", instance.name(), instance.mangled_name()).unwrap();
+            let _ = transformer.body(tcx, *instance).dump(&mut writer, &instance.name());
+        }
+    }
+}
diff --git a/kani-compiler/src/kani_middle/transform/kani_intrinsics.rs b/kani-compiler/src/kani_middle/transform/kani_intrinsics.rs
index 53bbd52086ac..c4534bf11b4d 100644
--- a/kani-compiler/src/kani_middle/transform/kani_intrinsics.rs
+++ b/kani-compiler/src/kani_middle/transform/kani_intrinsics.rs
@@ -7,8 +7,12 @@
 //! information; thus, they are implemented as a transformation pass where their body get generated
 //! by the transformation.
 
+use crate::args::{Arguments, ExtraChecks};
 use crate::kani_middle::attributes::matches_diagnostic;
-use crate::kani_middle::transform::body::{CheckType, MutableBody, SourceInstruction};
+use crate::kani_middle::transform::body::{
+    CheckType, InsertPosition, MutableBody, SourceInstruction,
+};
+use crate::kani_middle::transform::check_uninit::PointeeInfo;
 use crate::kani_middle::transform::check_values::{build_limits, ty_validity_per_offset};
 use crate::kani_middle::transform::{TransformPass, TransformationType};
 use crate::kani_queries::QueryDb;
@@ -18,15 +22,24 @@ use stable_mir::mir::{
     BinOp, Body, ConstOperand, Operand, Place, Rvalue, Statement, StatementKind, RETURN_LOCAL,
 };
 use stable_mir::target::MachineInfo;
-use stable_mir::ty::{MirConst, RigidTy, TyKind};
+use stable_mir::ty::{FnDef, MirConst, RigidTy, Ty, TyKind, UintTy};
+use std::collections::HashMap;
 use std::fmt::Debug;
 use strum_macros::AsRefStr;
 use tracing::trace;
 
+use super::check_uninit::{
+    get_mem_init_fn_def, mk_layout_operand, resolve_mem_init_fn, PointeeLayout,
+};
+
 /// Generate the body for a few Kani intrinsics.
 #[derive(Debug)]
 pub struct IntrinsicGeneratorPass {
     pub check_type: CheckType,
+    /// Used to cache FnDef lookups of injected memory initialization functions.
+    pub mem_init_fn_cache: HashMap<&'static str, FnDef>,
+    /// Used to enable intrinsics depending on the flags passed.
+    pub arguments: Arguments,
 }
 
 impl TransformPass for IntrinsicGeneratorPass {
@@ -46,10 +59,12 @@ impl TransformPass for IntrinsicGeneratorPass {
 
     /// Transform the function body by inserting checks one-by-one.
     /// For every unsafe dereference or a transmute operation, we check all values are valid.
-    fn transform(&self, tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body) {
+    fn transform(&mut self, tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body) {
         trace!(function=?instance.name(), "transform");
         if matches_diagnostic(tcx, instance.def, Intrinsics::KaniValidValue.as_ref()) {
             (true, self.valid_value_body(tcx, body))
+        } else if matches_diagnostic(tcx, instance.def, Intrinsics::KaniIsInitialized.as_ref()) {
+            (true, self.is_initialized_body(tcx, body))
         } else {
             (false, body)
         }
@@ -86,7 +101,7 @@ impl IntrinsicGeneratorPass {
             })),
         );
         let stmt = Statement { kind: assign, span };
-        new_body.insert_stmt(stmt, &mut terminator);
+        new_body.insert_stmt(stmt, &mut terminator, InsertPosition::Before);
         let machine_info = MachineInfo::target();
 
         // The first and only argument type.
@@ -110,7 +125,7 @@ impl IntrinsicGeneratorPass {
                     );
                     let assign = StatementKind::Assign(Place::from(ret_var), rvalue);
                     let stmt = Statement { kind: assign, span };
-                    new_body.insert_stmt(stmt, &mut terminator);
+                    new_body.insert_stmt(stmt, &mut terminator, InsertPosition::Before);
                 }
             }
             Err(msg) => {
@@ -120,11 +135,165 @@ impl IntrinsicGeneratorPass {
                     span,
                     user_ty: None,
                 }));
-                let result = new_body.new_assignment(rvalue, &mut terminator);
+                let result =
+                    new_body.new_assignment(rvalue, &mut terminator, InsertPosition::Before);
                 let reason = format!(
                     "Kani currently doesn't support checking validity of `{target_ty}`. {msg}"
                 );
-                new_body.add_check(tcx, &self.check_type, &mut terminator, result, &reason);
+                new_body.add_check(
+                    tcx,
+                    &self.check_type,
+                    &mut terminator,
+                    InsertPosition::Before,
+                    result,
+                    &reason,
+                );
+            }
+        }
+        new_body.into()
+    }
+
+    /// Generate the body for `is_initialized`, which looks like the following
+    ///
+    /// ```
+    /// pub fn is_initialized<T>(ptr: *const T, len: usize) -> bool {
+    ///     let layout = ... // Byte mask representing the layout of T.
+    ///     __kani_mem_init_sm_get(ptr, layout, len)
+    /// }
+    /// ```
+    fn is_initialized_body(&mut self, tcx: TyCtxt, body: Body) -> Body {
+        let mut new_body = MutableBody::from(body);
+        new_body.clear_body();
+
+        // Initialize return variable with True.
+        let ret_var = RETURN_LOCAL;
+        let mut terminator = SourceInstruction::Terminator { bb: 0 };
+        let span = new_body.locals()[ret_var].span;
+        let assign = StatementKind::Assign(
+            Place::from(ret_var),
+            Rvalue::Use(Operand::Constant(ConstOperand {
+                span,
+                user_ty: None,
+                const_: MirConst::from_bool(true),
+            })),
+        );
+        let stmt = Statement { kind: assign, span };
+        new_body.insert_stmt(stmt, &mut terminator, InsertPosition::Before);
+
+        if !self.arguments.ub_check.contains(&ExtraChecks::Uninit) {
+            // Short-circut if uninitialized memory checks are not enabled.
+            return new_body.into();
+        }
+
+        // The first argument type.
+        let arg_ty = new_body.locals()[1].ty;
+        let TyKind::RigidTy(RigidTy::RawPtr(target_ty, _)) = arg_ty.kind() else { unreachable!() };
+        let pointee_info = PointeeInfo::from_ty(target_ty);
+        match pointee_info {
+            Ok(pointee_info) => {
+                match pointee_info.layout() {
+                    PointeeLayout::Sized { layout } => {
+                        if layout.is_empty() {
+                            // Encountered a ZST, so we can short-circut here.
+                            return new_body.into();
+                        }
+                        let is_ptr_initialized_instance = resolve_mem_init_fn(
+                            get_mem_init_fn_def(
+                                tcx,
+                                "KaniIsPtrInitialized",
+                                &mut self.mem_init_fn_cache,
+                            ),
+                            layout.len(),
+                            *pointee_info.ty(),
+                        );
+                        let layout_operand = mk_layout_operand(
+                            &mut new_body,
+                            &mut terminator,
+                            InsertPosition::Before,
+                            &layout,
+                        );
+                        new_body.add_call(
+                            &is_ptr_initialized_instance,
+                            &mut terminator,
+                            InsertPosition::Before,
+                            vec![Operand::Copy(Place::from(1)), layout_operand],
+                            Place::from(ret_var),
+                        );
+                    }
+                    PointeeLayout::Slice { element_layout } => {
+                        // Since `str`` is a separate type, need to differentiate between [T] and str.
+                        let (slicee_ty, diagnostic) = match pointee_info.ty().kind() {
+                            TyKind::RigidTy(RigidTy::Slice(slicee_ty)) => {
+                                (slicee_ty, "KaniIsSlicePtrInitialized")
+                            }
+                            TyKind::RigidTy(RigidTy::Str) => {
+                                (Ty::unsigned_ty(UintTy::U8), "KaniIsStrPtrInitialized")
+                            }
+                            _ => unreachable!(),
+                        };
+                        let is_ptr_initialized_instance = resolve_mem_init_fn(
+                            get_mem_init_fn_def(tcx, diagnostic, &mut self.mem_init_fn_cache),
+                            element_layout.len(),
+                            slicee_ty,
+                        );
+                        let layout_operand = mk_layout_operand(
+                            &mut new_body,
+                            &mut terminator,
+                            InsertPosition::Before,
+                            &element_layout,
+                        );
+                        new_body.add_call(
+                            &is_ptr_initialized_instance,
+                            &mut terminator,
+                            InsertPosition::Before,
+                            vec![Operand::Copy(Place::from(1)), layout_operand],
+                            Place::from(ret_var),
+                        );
+                    }
+                    PointeeLayout::TraitObject => {
+                        let rvalue = Rvalue::Use(Operand::Constant(ConstOperand {
+                            const_: MirConst::from_bool(false),
+                            span,
+                            user_ty: None,
+                        }));
+                        let result = new_body.new_assignment(
+                            rvalue,
+                            &mut terminator,
+                            InsertPosition::Before,
+                        );
+                        let reason: &str = "Kani does not support reasoning about memory initialization of pointers to trait objects.";
+
+                        new_body.add_check(
+                            tcx,
+                            &self.check_type,
+                            &mut terminator,
+                            InsertPosition::Before,
+                            result,
+                            &reason,
+                        );
+                    }
+                };
+            }
+            Err(msg) => {
+                // We failed to retrieve the type layout.
+                let rvalue = Rvalue::Use(Operand::Constant(ConstOperand {
+                    const_: MirConst::from_bool(false),
+                    span,
+                    user_ty: None,
+                }));
+                let result =
+                    new_body.new_assignment(rvalue, &mut terminator, InsertPosition::Before);
+                let reason = format!(
+                    "Kani currently doesn't support checking memory initialization of `{target_ty}`. {msg}"
+                );
+                new_body.add_check(
+                    tcx,
+                    &self.check_type,
+                    &mut terminator,
+                    InsertPosition::Before,
+                    result,
+                    &reason,
+                );
             }
         }
         new_body.into()
@@ -135,4 +304,5 @@ impl IntrinsicGeneratorPass {
 #[strum(serialize_all = "PascalCase")]
 enum Intrinsics {
     KaniValidValue,
+    KaniIsInitialized,
 }
diff --git a/kani-compiler/src/kani_middle/transform/mod.rs b/kani-compiler/src/kani_middle/transform/mod.rs
index 8d5c61f55c92..5b497b09619d 100644
--- a/kani-compiler/src/kani_middle/transform/mod.rs
+++ b/kani-compiler/src/kani_middle/transform/mod.rs
@@ -17,21 +17,26 @@
 //! For all instrumentation passes, always use exhaustive matches to ensure soundness in case a new
 //! case is added.
 use crate::kani_middle::codegen_units::CodegenUnit;
+use crate::kani_middle::reachability::CallGraph;
 use crate::kani_middle::transform::body::CheckType;
+use crate::kani_middle::transform::check_uninit::UninitPass;
 use crate::kani_middle::transform::check_values::ValidValuePass;
 use crate::kani_middle::transform::contracts::AnyModifiesPass;
 use crate::kani_middle::transform::kani_intrinsics::IntrinsicGeneratorPass;
 use crate::kani_middle::transform::stubs::{ExternFnStubPass, FnStubPass};
 use crate::kani_queries::QueryDb;
+use dump_mir_pass::DumpMirPass;
 use rustc_middle::ty::TyCtxt;
-use stable_mir::mir::mono::Instance;
+use stable_mir::mir::mono::{Instance, MonoItem};
 use stable_mir::mir::Body;
 use std::collections::HashMap;
 use std::fmt::Debug;
 
 pub(crate) mod body;
+mod check_uninit;
 mod check_values;
 mod contracts;
+mod dump_mir_pass;
 mod kani_intrinsics;
 mod stubs;
 
@@ -58,17 +63,38 @@ impl BodyTransformation {
             inst_passes: vec![],
             cache: Default::default(),
         };
-        let check_type = CheckType::new(tcx);
+        let check_type = CheckType::new_assert_assume(tcx);
         transformer.add_pass(queries, FnStubPass::new(&unit.stubs));
         transformer.add_pass(queries, ExternFnStubPass::new(&unit.stubs));
         // This has to come after stubs since we want this to replace the stubbed body.
         transformer.add_pass(queries, AnyModifiesPass::new(tcx, &unit));
         transformer.add_pass(queries, ValidValuePass { check_type: check_type.clone() });
-        transformer.add_pass(queries, IntrinsicGeneratorPass { check_type });
+        // Putting `UninitPass` after `ValidValuePass` makes sure that the code generated by
+        // `UninitPass` does not get unnecessarily instrumented by valid value checks. However, it
+        // would also make sense to check that the values are initialized before checking their
+        // validity. In the future, it would be nice to have a mechanism to skip automatically
+        // generated code for future instrumentation passes.
+        transformer.add_pass(
+            queries,
+            UninitPass {
+                // Since this uses demonic non-determinism under the hood, should not assume the assertion.
+                check_type: CheckType::new_assert(tcx),
+                mem_init_fn_cache: HashMap::new(),
+            },
+        );
+        transformer.add_pass(
+            queries,
+            IntrinsicGeneratorPass {
+                check_type,
+                mem_init_fn_cache: HashMap::new(),
+                arguments: queries.args().clone(),
+            },
+        );
         transformer
     }
 
-    /// Retrieve the body of an instance.
+    /// Retrieve the body of an instance. This does not apply global passes, but will retrieve the
+    /// body after global passes running if they were previously applied.
     ///
     /// Note that this assumes that the instance does have a body since existing consumers already
     /// assume that. Use `instance.has_body()` to check if an instance has a body.
@@ -79,7 +105,7 @@ impl BodyTransformation {
             None => {
                 let mut body = instance.body().unwrap();
                 let mut modified = false;
-                for pass in self.stub_passes.iter().chain(self.inst_passes.iter()) {
+                for pass in self.stub_passes.iter_mut().chain(self.inst_passes.iter_mut()) {
                     let result = pass.transform(tcx, body, instance);
                     modified |= result.0;
                     body = result.1;
@@ -127,7 +153,24 @@ pub(crate) trait TransformPass: Debug {
         Self: Sized;
 
     /// Run a transformation pass in the function body.
-    fn transform(&self, tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body);
+    fn transform(&mut self, tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body);
+}
+
+/// A trait to represent transformation passes that operate on the whole codegen unit.
+pub(crate) trait GlobalPass: Debug {
+    fn is_enabled(&self, query_db: &QueryDb) -> bool
+    where
+        Self: Sized;
+
+    /// Run a transformation pass on the whole codegen unit.
+    fn transform(
+        &mut self,
+        tcx: TyCtxt,
+        call_graph: &CallGraph,
+        starting_items: &[MonoItem],
+        instances: Vec<Instance>,
+        transformer: &mut BodyTransformation,
+    );
 }
 
 /// The transformation result.
@@ -137,3 +180,37 @@ enum TransformationResult {
     Modified(Body),
     NotModified,
 }
+
+pub struct GlobalPasses {
+    /// The passes that operate on the whole codegen unit, they run after all previous passes are
+    /// done.
+    global_passes: Vec<Box<dyn GlobalPass>>,
+}
+
+impl GlobalPasses {
+    pub fn new(queries: &QueryDb, tcx: TyCtxt) -> Self {
+        let mut global_passes = GlobalPasses { global_passes: vec![] };
+        global_passes.add_global_pass(queries, DumpMirPass::new(tcx));
+        global_passes
+    }
+
+    fn add_global_pass<P: GlobalPass + 'static>(&mut self, query_db: &QueryDb, pass: P) {
+        if pass.is_enabled(&query_db) {
+            self.global_passes.push(Box::new(pass))
+        }
+    }
+
+    /// Run all global passes and store the results in a cache that can later be queried by `body`.
+    pub fn run_global_passes(
+        &mut self,
+        transformer: &mut BodyTransformation,
+        tcx: TyCtxt,
+        starting_items: &[MonoItem],
+        instances: Vec<Instance>,
+        call_graph: CallGraph,
+    ) {
+        for global_pass in self.global_passes.iter_mut() {
+            global_pass.transform(tcx, &call_graph, starting_items, instances.clone(), transformer);
+        }
+    }
+}
diff --git a/kani-compiler/src/kani_middle/transform/stubs.rs b/kani-compiler/src/kani_middle/transform/stubs.rs
index 4f249afdd45a..3dbd667c3943 100644
--- a/kani-compiler/src/kani_middle/transform/stubs.rs
+++ b/kani-compiler/src/kani_middle/transform/stubs.rs
@@ -43,7 +43,7 @@ impl TransformPass for FnStubPass {
     }
 
     /// Transform the function body by replacing it with the stub body.
-    fn transform(&self, tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body) {
+    fn transform(&mut self, tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body) {
         trace!(function=?instance.name(), "transform");
         let ty = instance.ty();
         if let TyKind::RigidTy(RigidTy::FnDef(fn_def, mut args)) = ty.kind() {
@@ -103,7 +103,7 @@ impl TransformPass for ExternFnStubPass {
     ///
     /// We need to find function calls and function pointers.
     /// We should replace this with a visitor once StableMIR includes a mutable one.
-    fn transform(&self, _tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body) {
+    fn transform(&mut self, _tcx: TyCtxt, body: Body, instance: Instance) -> (bool, Body) {
         trace!(function=?instance.name(), "transform");
         let mut new_body = MutableBody::from(body);
         let changed = false;
diff --git a/kani-compiler/src/main.rs b/kani-compiler/src/main.rs
index a5cfa347a85e..d2f8cf17e9e7 100644
--- a/kani-compiler/src/main.rs
+++ b/kani-compiler/src/main.rs
@@ -13,6 +13,8 @@
 #![feature(more_qualified_paths)]
 #![feature(iter_intersperse)]
 #![feature(let_chains)]
+#![feature(f128)]
+#![feature(f16)]
 extern crate rustc_abi;
 extern crate rustc_ast;
 extern crate rustc_ast_pretty;
diff --git a/kani-driver/Cargo.toml b/kani-driver/Cargo.toml
index 2263e39792e2..d58d686d7d43 100644
--- a/kani-driver/Cargo.toml
+++ b/kani-driver/Cargo.toml
@@ -3,7 +3,7 @@
 
 [package]
 name = "kani-driver"
-version = "0.52.0"
+version = "0.53.0"
 edition = "2021"
 description = "Build a project with Kani and run all proof harnesses"
 license = "MIT OR Apache-2.0"
diff --git a/kani-driver/src/args/mod.rs b/kani-driver/src/args/mod.rs
index 21807bc16636..158f1c001b5b 100644
--- a/kani-driver/src/args/mod.rs
+++ b/kani-driver/src/args/mod.rs
@@ -274,17 +274,6 @@ pub struct VerificationArgs {
     #[arg(long)]
     pub randomize_layout: Option<Option<u64>>,
 
-    /// Enable the stubbing of functions and methods.
-    // TODO: Stubbing should in principle work with concrete playback.
-    // <https://github.com/model-checking/kani/issues/1842>
-    #[arg(
-        long,
-        hide_short_help = true,
-        requires("enable_unstable"),
-        conflicts_with("concrete_playback")
-    )]
-    enable_stubbing: bool,
-
     /// Enable Kani coverage output alongside verification result
     #[arg(long, hide_short_help = true)]
     pub coverage: bool,
@@ -337,8 +326,7 @@ impl VerificationArgs {
 
     /// Is experimental stubbing enabled?
     pub fn is_stubbing_enabled(&self) -> bool {
-        self.enable_stubbing
-            || self.common_args.unstable_features.contains(UnstableFeature::Stubbing)
+        self.common_args.unstable_features.contains(UnstableFeature::Stubbing)
             || self.is_function_contracts_enabled()
     }
 }
@@ -571,6 +559,13 @@ impl ValidateArgs for VerificationArgs {
                 --output-format=old.",
             ));
         }
+        if self.concrete_playback.is_some() && self.is_stubbing_enabled() {
+            // Concrete playback currently does not work with contracts or stubbing.
+            return Err(Error::raw(
+                ErrorKind::ArgumentConflict,
+                "Conflicting options: --concrete-playback isn't compatible with stubbing.",
+            ));
+        }
         if self.concrete_playback.is_some() && self.jobs() != Some(1) {
             // Concrete playback currently embeds a lot of assumptions about the order in which harnesses get called.
             return Err(Error::raw(
@@ -598,10 +593,6 @@ impl ValidateArgs for VerificationArgs {
             }
         }
 
-        if self.enable_stubbing {
-            print_deprecated(&self.common_args, "--enable-stubbing", "-Z stubbing");
-        }
-
         if self.concrete_playback.is_some()
             && !self.common_args.unstable_features.contains(UnstableFeature::ConcretePlayback)
         {
@@ -872,14 +863,18 @@ mod tests {
 
     #[test]
     fn check_enable_stubbing() {
-        check_unstable_flag!("--enable-stubbing --harness foo", enable_stubbing);
+        let res = parse_unstable_disabled("--harness foo").unwrap();
+        assert!(!res.verify_opts.is_stubbing_enabled());
 
-        check_unstable_flag!("--enable-stubbing", enable_stubbing);
+        let res = parse_unstable_disabled("--harness foo -Z stubbing").unwrap();
+        assert!(res.verify_opts.is_stubbing_enabled());
 
-        // `--enable-stubbing` cannot be called with `--concrete-playback`
-        let err =
-            parse_unstable_enabled("--enable-stubbing --harness foo --concrete-playback=print")
-                .unwrap_err();
+        // `-Z stubbing` cannot be called with `--concrete-playback`
+        let res = parse_unstable_disabled(
+            "--harness foo --concrete-playback=print -Z concrete-playback -Z stubbing",
+        )
+        .unwrap();
+        let err = res.validate().unwrap_err();
         assert_eq!(err.kind(), ErrorKind::ArgumentConflict);
     }
 
diff --git a/kani-driver/src/call_single_file.rs b/kani-driver/src/call_single_file.rs
index 1ba3f51bf5a4..bbeb5bfa417d 100644
--- a/kani-driver/src/call_single_file.rs
+++ b/kani-driver/src/call_single_file.rs
@@ -139,6 +139,13 @@ impl KaniSession {
             flags.push("--ub-check=ptr_to_ref_cast".into())
         }
 
+        if self.args.common_args.unstable_features.contains(UnstableFeature::UninitChecks) {
+            // Automatically enable shadow memory, since the version of uninitialized memory checks
+            // without non-determinism depends on it.
+            flags.push("-Z ghost-state".into());
+            flags.push("--ub-check=uninit".into());
+        }
+
         flags.extend(self.args.common_args.unstable_features.as_arguments().map(str::to_string));
 
         // This argument will select the Kani flavour of the compiler. It will be removed before
diff --git a/kani_metadata/Cargo.toml b/kani_metadata/Cargo.toml
index f9d701018367..816752a58e03 100644
--- a/kani_metadata/Cargo.toml
+++ b/kani_metadata/Cargo.toml
@@ -3,7 +3,7 @@
 
 [package]
 name = "kani_metadata"
-version = "0.52.0"
+version = "0.53.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 publish = false
diff --git a/kani_metadata/src/unstable.rs b/kani_metadata/src/unstable.rs
index 9f82e4b02a64..68e4fba28819 100644
--- a/kani_metadata/src/unstable.rs
+++ b/kani_metadata/src/unstable.rs
@@ -91,6 +91,8 @@ pub enum UnstableFeature {
     GhostState,
     /// Automatically check that pointers are valid when casting them to references.
     PtrToRefCastChecks,
+    /// Automatically check that uninitialized memory is not used.
+    UninitChecks,
     /// Enable an unstable option or subcommand.
     UnstableOptions,
 }
diff --git a/library/kani/Cargo.toml b/library/kani/Cargo.toml
index c0f783e65315..91fee3dabf30 100644
--- a/library/kani/Cargo.toml
+++ b/library/kani/Cargo.toml
@@ -3,7 +3,7 @@
 
 [package]
 name = "kani"
-version = "0.52.0"
+version = "0.53.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 publish = false
diff --git a/library/kani/kani_lib.c b/library/kani/kani_lib.c
index b077547b10d7..eca17a3abb0e 100644
--- a/library/kani/kani_lib.c
+++ b/library/kani/kani_lib.c
@@ -8,6 +8,7 @@
 void  free(void *ptr);
 void *memcpy(void *dst, const void *src, size_t n);
 void *calloc(size_t nmemb, size_t size);
+void *malloc(size_t size);
 
 typedef __CPROVER_bool bool;
 
diff --git a/library/kani/src/arbitrary.rs b/library/kani/src/arbitrary.rs
index 3f1adc787b79..424ca2485d57 100644
--- a/library/kani/src/arbitrary.rs
+++ b/library/kani/src/arbitrary.rs
@@ -71,6 +71,10 @@ trivial_arbitrary!(isize);
 trivial_arbitrary!(f32);
 trivial_arbitrary!(f64);
 
+// Similarly, we do not constraint values for non-standard floating types.
+trivial_arbitrary!(f16);
+trivial_arbitrary!(f128);
+
 trivial_arbitrary!(());
 
 impl Arbitrary for bool {
diff --git a/library/kani/src/internal.rs b/library/kani/src/internal.rs
index a910c333b112..22026065106a 100644
--- a/library/kani/src/internal.rs
+++ b/library/kani/src/internal.rs
@@ -1,13 +1,16 @@
 // Copyright Kani Contributors
 // SPDX-License-Identifier: Apache-2.0 OR MIT
 
+use crate::arbitrary::Arbitrary;
+use std::ptr;
+
 /// Helper trait for code generation for `modifies` contracts.
 ///
 /// We allow the user to provide us with a pointer-like object that we convert as needed.
 #[doc(hidden)]
 pub trait Pointer<'a> {
     /// Type of the pointed-to data
-    type Inner;
+    type Inner: ?Sized;
 
     /// Used for checking assigns contracts where we pass immutable references to the function.
     ///
@@ -15,23 +18,21 @@ pub trait Pointer<'a> {
     /// argument, for instance one of type `&mut _`, in the `modifies` clause which would move it.
     unsafe fn decouple_lifetime(&self) -> &'a Self::Inner;
 
-    /// used for havocking on replecement of a `modifies` clause.
-    unsafe fn assignable(self) -> &'a mut Self::Inner;
+    unsafe fn assignable(self) -> *mut Self::Inner;
 }
 
-impl<'a, 'b, T> Pointer<'a> for &'b T {
+impl<'a, 'b, T: ?Sized> Pointer<'a> for &'b T {
     type Inner = T;
     unsafe fn decouple_lifetime(&self) -> &'a Self::Inner {
         std::mem::transmute(*self)
     }
 
-    #[allow(clippy::transmute_ptr_to_ref)]
-    unsafe fn assignable(self) -> &'a mut Self::Inner {
+    unsafe fn assignable(self) -> *mut Self::Inner {
         std::mem::transmute(self as *const T)
     }
 }
 
-impl<'a, 'b, T> Pointer<'a> for &'b mut T {
+impl<'a, 'b, T: ?Sized> Pointer<'a> for &'b mut T {
     type Inner = T;
 
     #[allow(clippy::transmute_ptr_to_ref)]
@@ -39,32 +40,30 @@ impl<'a, 'b, T> Pointer<'a> for &'b mut T {
         std::mem::transmute::<_, &&'a T>(self)
     }
 
-    unsafe fn assignable(self) -> &'a mut Self::Inner {
-        std::mem::transmute(self)
+    unsafe fn assignable(self) -> *mut Self::Inner {
+        self as *mut T
     }
 }
 
-impl<'a, T> Pointer<'a> for *const T {
+impl<'a, T: ?Sized> Pointer<'a> for *const T {
     type Inner = T;
     unsafe fn decouple_lifetime(&self) -> &'a Self::Inner {
         &**self as &'a T
     }
 
-    #[allow(clippy::transmute_ptr_to_ref)]
-    unsafe fn assignable(self) -> &'a mut Self::Inner {
+    unsafe fn assignable(self) -> *mut Self::Inner {
         std::mem::transmute(self)
     }
 }
 
-impl<'a, T> Pointer<'a> for *mut T {
+impl<'a, T: ?Sized> Pointer<'a> for *mut T {
     type Inner = T;
     unsafe fn decouple_lifetime(&self) -> &'a Self::Inner {
         &**self as &'a T
     }
 
-    #[allow(clippy::transmute_ptr_to_ref)]
-    unsafe fn assignable(self) -> &'a mut Self::Inner {
-        std::mem::transmute(self)
+    unsafe fn assignable(self) -> *mut Self::Inner {
+        self
     }
 }
 
@@ -90,3 +89,56 @@ pub fn untracked_deref<T>(_: &T) -> T {
 #[doc(hidden)]
 #[rustc_diagnostic_item = "KaniInitContracts"]
 pub fn init_contracts() {}
+
+/// This should only be used within contracts. The intent is to
+/// perform type inference on a closure's argument
+#[doc(hidden)]
+pub fn apply_closure<T, U: Fn(&T) -> bool>(f: U, x: &T) -> bool {
+    f(x)
+}
+
+/// Recieves a reference to a pointer-like object and assigns kani::any_modifies to that object.
+/// Only for use within function contracts and will not be replaced if the recursive or function stub
+/// replace contracts are not used.
+#[crate::unstable(feature = "function-contracts", issue = "none", reason = "function-contracts")]
+#[rustc_diagnostic_item = "KaniWriteAny"]
+#[inline(never)]
+#[doc(hidden)]
+pub unsafe fn write_any<T: ?Sized>(_pointer: *mut T) {
+    // This function should not be reacheable.
+    // Users must include `#[kani::recursion]` in any function contracts for recursive functions;
+    // otherwise, this might not be properly instantiate. We mark this as unreachable to make
+    // sure Kani doesn't report any false positives.
+    unreachable!()
+}
+
+/// Fill in a slice with kani::any.
+/// Intended as a post compilation replacement for write_any
+#[crate::unstable(feature = "function-contracts", issue = "none", reason = "function-contracts")]
+#[rustc_diagnostic_item = "KaniWriteAnySlice"]
+#[inline(always)]
+pub unsafe fn write_any_slice<T: Arbitrary>(slice: *mut [T]) {
+    (*slice).fill_with(T::any)
+}
+
+/// Fill in a pointer with kani::any.
+/// Intended as a post compilation replacement for write_any
+#[crate::unstable(feature = "function-contracts", issue = "none", reason = "function-contracts")]
+#[rustc_diagnostic_item = "KaniWriteAnySlim"]
+#[inline(always)]
+pub unsafe fn write_any_slim<T: Arbitrary>(pointer: *mut T) {
+    ptr::write(pointer, T::any())
+}
+
+/// Fill in a str with kani::any.
+/// Intended as a post compilation replacement for write_any.
+/// Not yet implemented
+#[crate::unstable(feature = "function-contracts", issue = "none", reason = "function-contracts")]
+#[rustc_diagnostic_item = "KaniWriteAnyStr"]
+#[inline(always)]
+pub unsafe fn write_any_str(_s: *mut str) {
+    //TODO: strings introduce new UB
+    //(*s).as_bytes_mut().fill_with(u8::any)
+    //TODO: String validation
+    unimplemented!("Kani does not support creating arbitrary `str`")
+}
diff --git a/library/kani/src/invariant.rs b/library/kani/src/invariant.rs
index f118f94e995c..068cdedc277e 100644
--- a/library/kani/src/invariant.rs
+++ b/library/kani/src/invariant.rs
@@ -96,6 +96,8 @@ trivial_invariant!(isize);
 // invariant that checks for NaN, infinite, or subnormal values.
 trivial_invariant!(f32);
 trivial_invariant!(f64);
+trivial_invariant!(f16);
+trivial_invariant!(f128);
 
 trivial_invariant!(());
 trivial_invariant!(bool);
diff --git a/library/kani/src/lib.rs b/library/kani/src/lib.rs
index acf1e08e0441..7487cc26b186 100644
--- a/library/kani/src/lib.rs
+++ b/library/kani/src/lib.rs
@@ -18,6 +18,8 @@
 #![allow(internal_features)]
 // Required for implementing memory predicates.
 #![feature(ptr_metadata)]
+#![feature(f16)]
+#![feature(f128)]
 
 pub mod arbitrary;
 #[cfg(feature = "concrete_playback")]
@@ -33,6 +35,7 @@ pub mod vec;
 #[doc(hidden)]
 pub mod internal;
 
+mod mem_init;
 mod models;
 
 pub use arbitrary::Arbitrary;
@@ -120,6 +123,30 @@ pub const fn assert(cond: bool, msg: &'static str) {
     assert!(cond, "{}", msg);
 }
 
+/// Creates an assertion of the specified condition, but does not assume it afterwards.
+///
+/// # Example:
+///
+/// ```rust
+/// let x: bool = kani::any();
+/// let y = !x;
+/// kani::check(x || y, "ORing a boolean variable with its negation must be true")
+/// ```
+#[cfg(not(feature = "concrete_playback"))]
+#[inline(never)]
+#[rustc_diagnostic_item = "KaniCheck"]
+pub const fn check(cond: bool, msg: &'static str) {
+    let _ = cond;
+    let _ = msg;
+}
+
+#[cfg(feature = "concrete_playback")]
+#[inline(never)]
+#[rustc_diagnostic_item = "KaniCheck"]
+pub const fn check(cond: bool, msg: &'static str) {
+    assert!(cond, "{}", msg);
+}
+
 /// Creates a cover property with the specified condition and message.
 ///
 /// # Example:
diff --git a/library/kani/src/mem.rs b/library/kani/src/mem.rs
index c40a1aa696e3..f718c09ec38d 100644
--- a/library/kani/src/mem.rs
+++ b/library/kani/src/mem.rs
@@ -118,8 +118,11 @@ where
     <T as Pointee>::Metadata: PtrProperties<T>,
 {
     let (thin_ptr, metadata) = ptr.to_raw_parts();
+    // Need to assert `is_initialized` because non-determinism is used under the hood, so it does
+    // not make sense to use it inside assumption context.
     metadata.is_ptr_aligned(thin_ptr, Internal)
         && is_inbounds(&metadata, thin_ptr)
+        && assert_is_initialized(ptr)
         && unsafe { has_valid_value(ptr) }
 }
 
@@ -147,7 +150,11 @@ where
     <T as Pointee>::Metadata: PtrProperties<T>,
 {
     let (thin_ptr, metadata) = ptr.to_raw_parts();
-    is_inbounds(&metadata, thin_ptr) && unsafe { has_valid_value(ptr) }
+    // Need to assert `is_initialized` because non-determinism is used under the hood, so it does
+    // not make sense to use it inside assumption context.
+    is_inbounds(&metadata, thin_ptr)
+        && assert_is_initialized(ptr)
+        && unsafe { has_valid_value(ptr) }
 }
 
 /// Checks that `data_ptr` points to an allocation that can hold data of size calculated from `T`.
@@ -290,7 +297,26 @@ unsafe fn has_valid_value<T: ?Sized>(_ptr: *const T) -> bool {
     kani_intrinsic()
 }
 
+/// Check whether `len * size_of::<T>()` bytes are initialized starting from `ptr`.
+#[rustc_diagnostic_item = "KaniIsInitialized"]
+#[inline(never)]
+pub(crate) fn is_initialized<T: ?Sized>(_ptr: *const T) -> bool {
+    kani_intrinsic()
+}
+
+/// A helper to assert `is_initialized` to use it as a part of other predicates.
+fn assert_is_initialized<T: ?Sized>(ptr: *const T) -> bool {
+    crate::check(is_initialized(ptr), "Undefined Behavior: Reading from an uninitialized pointer");
+    true
+}
+
 /// Get the object ID of the given pointer.
+#[doc(hidden)]
+#[crate::unstable(
+    feature = "ghost-state",
+    issue = 3184,
+    reason = "experimental ghost state/shadow memory API"
+)]
 #[rustc_diagnostic_item = "KaniPointerObject"]
 #[inline(never)]
 pub fn pointer_object<T: ?Sized>(_ptr: *const T) -> usize {
@@ -298,6 +324,12 @@ pub fn pointer_object<T: ?Sized>(_ptr: *const T) -> usize {
 }
 
 /// Get the object offset of the given pointer.
+#[doc(hidden)]
+#[crate::unstable(
+    feature = "ghost-state",
+    issue = 3184,
+    reason = "experimental ghost state/shadow memory API"
+)]
 #[rustc_diagnostic_item = "KaniPointerOffset"]
 #[inline(never)]
 pub fn pointer_offset<T: ?Sized>(_ptr: *const T) -> usize {
diff --git a/library/kani/src/mem_init.rs b/library/kani/src/mem_init.rs
new file mode 100644
index 000000000000..88847e9c4f3c
--- /dev/null
+++ b/library/kani/src/mem_init.rs
@@ -0,0 +1,283 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! This module provides instrumentation for tracking memory initialization of raw pointers.
+//!
+//! Currently, memory initialization is tracked on per-byte basis, so each byte of memory pointed to
+//! by raw pointers could be either initialized or uninitialized. Padding bytes are always
+//! considered uninitialized when read as data bytes. Each type has a type layout to specify which
+//! bytes are considered to be data and which -- padding. This is determined at compile time and
+//! statically injected into the program (see `Layout`).
+//!
+//! Compiler automatically inserts calls to `is_xxx_initialized` and `set_xxx_initialized` at
+//! appropriate locations to get or set the initialization status of the memory pointed to.
+//!
+//! Note that for each harness, tracked object and tracked offset are chosen non-deterministically,
+//! so calls to `is_xxx_initialized` should be only used in assertion contexts.
+
+// Definitions in this module are not meant to be visible to the end user, only the compiler.
+#![allow(dead_code)]
+
+/// Bytewise mask, representing which bytes of a type are data and which are padding.
+/// For example, for a type like this:
+/// ```
+/// #[repr(C)]
+/// struct Foo {
+///     a: u16,
+///     b: u8,
+/// }
+/// ```
+/// the layout would be [true, true, true, false];
+type Layout<const LAYOUT_SIZE: usize> = [bool; LAYOUT_SIZE];
+
+/// Currently tracked non-deterministically chosen memory initialization state.
+struct MemoryInitializationState {
+    pub tracked_object_id: usize,
+    pub tracked_offset: usize,
+    pub value: bool,
+}
+
+impl MemoryInitializationState {
+    /// This is a dummy initialization function -- the values will be eventually overwritten by a
+    /// call to `initialize_memory_initialization_state`.
+    pub const fn new() -> Self {
+        Self { tracked_object_id: 0, tracked_offset: 0, value: false }
+    }
+
+    /// Return currently tracked memory initialization state if `ptr` points to the currently
+    /// tracked object and the tracked offset lies within `LAYOUT_SIZE` bytes of `ptr`. Return
+    /// `true` otherwise.
+    ///
+    /// Such definition is necessary since both tracked object and tracked offset are chosen
+    /// non-deterministically.
+    #[kanitool::disable_checks(pointer)]
+    pub fn get<const LAYOUT_SIZE: usize>(
+        &mut self,
+        ptr: *const u8,
+        layout: Layout<LAYOUT_SIZE>,
+    ) -> bool {
+        let obj = crate::mem::pointer_object(ptr);
+        let offset = crate::mem::pointer_offset(ptr);
+        if self.tracked_object_id == obj
+            && self.tracked_offset >= offset
+            && self.tracked_offset < offset + LAYOUT_SIZE
+        {
+            !layout[self.tracked_offset - offset] || self.value
+        } else {
+            true
+        }
+    }
+
+    /// Set currently tracked memory initialization state if `ptr` points to the currently tracked
+    /// object and the tracked offset lies within `LAYOUT_SIZE` bytes of `ptr`. Do nothing
+    /// otherwise.
+    ///
+    /// Such definition is necessary since both tracked object and tracked offset are chosen
+    /// non-deterministically.
+    #[kanitool::disable_checks(pointer)]
+    pub fn set<const LAYOUT_SIZE: usize>(
+        &mut self,
+        ptr: *const u8,
+        layout: Layout<LAYOUT_SIZE>,
+        value: bool,
+    ) {
+        let obj = crate::mem::pointer_object(ptr);
+        let offset = crate::mem::pointer_offset(ptr);
+        if self.tracked_object_id == obj
+            && self.tracked_offset >= offset
+            && self.tracked_offset < offset + LAYOUT_SIZE
+        {
+            self.value = layout[self.tracked_offset - offset] && value;
+        }
+    }
+
+    /// Return currently tracked memory initialization state if `ptr` points to the currently
+    /// tracked object and the tracked offset lies within `LAYOUT_SIZE * num_elts` bytes of `ptr`.
+    /// Return `true` otherwise.
+    ///
+    /// Such definition is necessary since both tracked object and tracked offset are chosen
+    /// non-deterministically.
+    #[kanitool::disable_checks(pointer)]
+    pub fn get_slice<const LAYOUT_SIZE: usize>(
+        &mut self,
+        ptr: *const u8,
+        layout: Layout<LAYOUT_SIZE>,
+        num_elts: usize,
+    ) -> bool {
+        let obj = crate::mem::pointer_object(ptr);
+        let offset = crate::mem::pointer_offset(ptr);
+        if self.tracked_object_id == obj
+            && self.tracked_offset >= offset
+            && self.tracked_offset < offset + num_elts * LAYOUT_SIZE
+        {
+            !layout[(self.tracked_offset - offset) % LAYOUT_SIZE] || self.value
+        } else {
+            true
+        }
+    }
+
+    /// Set currently tracked memory initialization state if `ptr` points to the currently tracked
+    /// object and the tracked offset lies within `LAYOUT_SIZE * num_elts` bytes of `ptr`. Do
+    /// nothing otherwise.
+    ///
+    /// Such definition is necessary since both tracked object and tracked offset are chosen
+    /// non-deterministically.
+    #[kanitool::disable_checks(pointer)]
+    pub fn set_slice<const LAYOUT_SIZE: usize>(
+        &mut self,
+        ptr: *const u8,
+        layout: Layout<LAYOUT_SIZE>,
+        num_elts: usize,
+        value: bool,
+    ) {
+        let obj = crate::mem::pointer_object(ptr);
+        let offset = crate::mem::pointer_offset(ptr);
+        if self.tracked_object_id == obj
+            && self.tracked_offset >= offset
+            && self.tracked_offset < offset + num_elts * LAYOUT_SIZE
+        {
+            self.value = layout[(self.tracked_offset - offset) % LAYOUT_SIZE] && value;
+        }
+    }
+}
+
+/// Global object for tracking memory initialization state.
+#[rustc_diagnostic_item = "KaniMemoryInitializationState"]
+static mut MEM_INIT_STATE: MemoryInitializationState = MemoryInitializationState::new();
+
+/// Set tracked object and tracked offset to a non-deterministic value.
+#[kanitool::disable_checks(pointer)]
+#[rustc_diagnostic_item = "KaniInitializeMemoryInitializationState"]
+fn initialize_memory_initialization_state() {
+    unsafe {
+        MEM_INIT_STATE.tracked_object_id = crate::any();
+        MEM_INIT_STATE.tracked_offset = crate::any();
+        MEM_INIT_STATE.value = false;
+    }
+}
+
+/// Get initialization state of `num_elts` items laid out according to the `layout` starting at address `ptr`.
+#[kanitool::disable_checks(pointer)]
+#[rustc_diagnostic_item = "KaniIsPtrInitialized"]
+fn is_ptr_initialized<const LAYOUT_SIZE: usize, T>(
+    ptr: *const T,
+    layout: Layout<LAYOUT_SIZE>,
+) -> bool {
+    if LAYOUT_SIZE == 0 {
+        return true;
+    }
+    let (ptr, _) = ptr.to_raw_parts();
+    unsafe { MEM_INIT_STATE.get(ptr as *const u8, layout) }
+}
+
+/// Set initialization state to `value` for `num_elts` items laid out according to the `layout` starting at address `ptr`.
+#[kanitool::disable_checks(pointer)]
+#[rustc_diagnostic_item = "KaniSetPtrInitialized"]
+fn set_ptr_initialized<const LAYOUT_SIZE: usize, T>(
+    ptr: *const T,
+    layout: Layout<LAYOUT_SIZE>,
+    value: bool,
+) {
+    if LAYOUT_SIZE == 0 {
+        return;
+    }
+    let (ptr, _) = ptr.to_raw_parts();
+    unsafe {
+        MEM_INIT_STATE.set(ptr as *const u8, layout, value);
+    }
+}
+
+/// Get initialization state of `num_elts` items laid out according to the `layout` starting at address `ptr`.
+#[kanitool::disable_checks(pointer)]
+#[rustc_diagnostic_item = "KaniIsSliceChunkPtrInitialized"]
+fn is_slice_chunk_ptr_initialized<const LAYOUT_SIZE: usize, T>(
+    ptr: *const T,
+    layout: Layout<LAYOUT_SIZE>,
+    num_elts: usize,
+) -> bool {
+    if LAYOUT_SIZE == 0 {
+        return true;
+    }
+    let (ptr, _) = ptr.to_raw_parts();
+    unsafe { MEM_INIT_STATE.get_slice(ptr as *const u8, layout, num_elts) }
+}
+
+/// Set initialization state to `value` for `num_elts` items laid out according to the `layout` starting at address `ptr`.
+#[kanitool::disable_checks(pointer)]
+#[rustc_diagnostic_item = "KaniSetSliceChunkPtrInitialized"]
+fn set_slice_chunk_ptr_initialized<const LAYOUT_SIZE: usize, T>(
+    ptr: *const T,
+    layout: Layout<LAYOUT_SIZE>,
+    num_elts: usize,
+    value: bool,
+) {
+    if LAYOUT_SIZE == 0 {
+        return;
+    }
+    let (ptr, _) = ptr.to_raw_parts();
+    unsafe {
+        MEM_INIT_STATE.set_slice(ptr as *const u8, layout, num_elts, value);
+    }
+}
+
+/// Get initialization state of the slice, items of which are laid out according to the `layout` starting at address `ptr`.
+#[kanitool::disable_checks(pointer)]
+#[rustc_diagnostic_item = "KaniIsSlicePtrInitialized"]
+fn is_slice_ptr_initialized<const LAYOUT_SIZE: usize, T>(
+    ptr: *const [T],
+    layout: Layout<LAYOUT_SIZE>,
+) -> bool {
+    if LAYOUT_SIZE == 0 {
+        return true;
+    }
+    let (ptr, num_elts) = ptr.to_raw_parts();
+    unsafe { MEM_INIT_STATE.get_slice(ptr as *const u8, layout, num_elts) }
+}
+
+/// Set initialization state of the slice, items of which are laid out according to the `layout` starting at address `ptr` to `value`.
+#[kanitool::disable_checks(pointer)]
+#[rustc_diagnostic_item = "KaniSetSlicePtrInitialized"]
+fn set_slice_ptr_initialized<const LAYOUT_SIZE: usize, T>(
+    ptr: *const [T],
+    layout: Layout<LAYOUT_SIZE>,
+    value: bool,
+) {
+    if LAYOUT_SIZE == 0 {
+        return;
+    }
+    let (ptr, num_elts) = ptr.to_raw_parts();
+    unsafe {
+        MEM_INIT_STATE.set_slice(ptr as *const u8, layout, num_elts, value);
+    }
+}
+
+/// Get initialization state of the string slice, items of which are laid out according to the `layout` starting at address `ptr`.
+#[kanitool::disable_checks(pointer)]
+#[rustc_diagnostic_item = "KaniIsStrPtrInitialized"]
+fn is_str_ptr_initialized<const LAYOUT_SIZE: usize>(
+    ptr: *const str,
+    layout: Layout<LAYOUT_SIZE>,
+) -> bool {
+    if LAYOUT_SIZE == 0 {
+        return true;
+    }
+    let (ptr, num_elts) = ptr.to_raw_parts();
+    unsafe { MEM_INIT_STATE.get_slice(ptr as *const u8, layout, num_elts) }
+}
+
+/// Set initialization state of the string slice, items of which are laid out according to the `layout` starting at address `ptr` to `value`.
+#[kanitool::disable_checks(pointer)]
+#[rustc_diagnostic_item = "KaniSetStrPtrInitialized"]
+fn set_str_ptr_initialized<const LAYOUT_SIZE: usize>(
+    ptr: *const str,
+    layout: Layout<LAYOUT_SIZE>,
+    value: bool,
+) {
+    if LAYOUT_SIZE == 0 {
+        return;
+    }
+    let (ptr, num_elts) = ptr.to_raw_parts();
+    unsafe {
+        MEM_INIT_STATE.set_slice(ptr as *const u8, layout, num_elts, value);
+    }
+}
diff --git a/library/kani_core/Cargo.toml b/library/kani_core/Cargo.toml
index 6f5230c6d19b..ec12209f0e08 100644
--- a/library/kani_core/Cargo.toml
+++ b/library/kani_core/Cargo.toml
@@ -3,7 +3,7 @@
 
 [package]
 name = "kani_core"
-version = "0.52.0"
+version = "0.53.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 publish = false
diff --git a/library/kani_core/src/arbitrary.rs b/library/kani_core/src/arbitrary.rs
index d202df4ead1d..a8271ad758cf 100644
--- a/library/kani_core/src/arbitrary.rs
+++ b/library/kani_core/src/arbitrary.rs
@@ -88,6 +88,15 @@ macro_rules! generate_arbitrary {
         trivial_arbitrary!(i128);
         trivial_arbitrary!(isize);
 
+        // We do not constrain floating points values per type spec. Users must add assumptions to their
+        // verification code if they want to eliminate NaN, infinite, or subnormal.
+        trivial_arbitrary!(f32);
+        trivial_arbitrary!(f64);
+
+        // Similarly, we do not constraint values for non-standard floating types.
+        trivial_arbitrary!(f16);
+        trivial_arbitrary!(f128);
+
         nonzero_arbitrary!(NonZeroU8, u8);
         nonzero_arbitrary!(NonZeroU16, u16);
         nonzero_arbitrary!(NonZeroU32, u32);
diff --git a/library/kani_core/src/lib.rs b/library/kani_core/src/lib.rs
index de808ffaf918..68a8e79658f1 100644
--- a/library/kani_core/src/lib.rs
+++ b/library/kani_core/src/lib.rs
@@ -17,6 +17,8 @@
 
 #![feature(no_core)]
 #![no_core]
+#![feature(f16)]
+#![feature(f128)]
 
 mod arbitrary;
 mod mem;
@@ -122,6 +124,30 @@ macro_rules! kani_intrinsics {
             assert!(cond, "{}", msg);
         }
 
+        /// Creates an assertion of the specified condition and message, but does not assume it afterwards.
+        ///
+        /// # Example:
+        ///
+        /// ```rust
+        /// let x: bool = kani::any();
+        /// let y = !x;
+        /// kani::check(x || y, "ORing a boolean variable with its negation must be true")
+        /// ```
+        #[cfg(not(feature = "concrete_playback"))]
+        #[inline(never)]
+        #[rustc_diagnostic_item = "KaniCheck"]
+        pub const fn check(cond: bool, msg: &'static str) {
+            let _ = cond;
+            let _ = msg;
+        }
+
+        #[cfg(feature = "concrete_playback")]
+        #[inline(never)]
+        #[rustc_diagnostic_item = "KaniCheck"]
+        pub const fn check(cond: bool, msg: &'static str) {
+            assert!(cond, "{}", msg);
+        }
+
         /// Creates a cover property with the specified condition and message.
         ///
         /// # Example:
diff --git a/library/kani_core/src/mem.rs b/library/kani_core/src/mem.rs
index 8dd4a27cb03a..0b029ad53089 100644
--- a/library/kani_core/src/mem.rs
+++ b/library/kani_core/src/mem.rs
@@ -123,8 +123,11 @@ macro_rules! kani_mem {
             <T as Pointee>::Metadata: PtrProperties<T>,
         {
             let (thin_ptr, metadata) = ptr.to_raw_parts();
+            // Need to assert `is_initialized` because non-determinism is used under the hood, so it
+            // does not make sense to use it inside assumption context.
             metadata.is_ptr_aligned(thin_ptr, Internal)
                 && is_inbounds(&metadata, thin_ptr)
+                && assert_is_initialized(ptr)
                 && unsafe { has_valid_value(ptr) }
         }
 
@@ -153,7 +156,11 @@ macro_rules! kani_mem {
             <T as Pointee>::Metadata: PtrProperties<T>,
         {
             let (thin_ptr, metadata) = ptr.to_raw_parts();
-            is_inbounds(&metadata, thin_ptr) && unsafe { has_valid_value(ptr) }
+            // Need to assert `is_initialized` because non-determinism is used under the hood, so it
+            // does not make sense to use it inside assumption context.
+            is_inbounds(&metadata, thin_ptr)
+                && assert_is_initialized(ptr)
+                && unsafe { has_valid_value(ptr) }
         }
 
         /// Checks that `data_ptr` points to an allocation that can hold data of size calculated from `T`.
@@ -296,17 +303,47 @@ macro_rules! kani_mem {
             kani_intrinsic()
         }
 
+        /// Check whether `len * size_of::<T>()` bytes are initialized starting from `ptr`.
+        #[rustc_diagnostic_item = "KaniIsInitialized"]
+        #[inline(never)]
+        pub(crate) fn is_initialized<T: ?Sized>(_ptr: *const T) -> bool {
+            kani_intrinsic()
+        }
+
+        /// A helper to assert `is_initialized` to use it as a part of other predicates.
+        fn assert_is_initialized<T: ?Sized>(ptr: *const T) -> bool {
+            super::check(
+                is_initialized(ptr),
+                "Undefined Behavior: Reading from an uninitialized pointer",
+            );
+            true
+        }
+
         /// Get the object ID of the given pointer.
+        // TODO: Add this back later, as there is no unstable attribute here.
+        // #[doc(hidden)]
+        // #[crate::unstable(
+        //     feature = "ghost-state",
+        //     issue = 3184,
+        //     reason = "experimental ghost state/shadow memory API"
+        // )]
         #[rustc_diagnostic_item = "KaniPointerObject"]
         #[inline(never)]
-        pub fn pointer_object<T: ?Sized>(_ptr: *const T) -> usize {
+        pub(crate) fn pointer_object<T: ?Sized>(_ptr: *const T) -> usize {
             kani_intrinsic()
         }
 
         /// Get the object offset of the given pointer.
+        // TODO: Add this back later, as there is no unstable attribute here.
+        // #[doc(hidden)]
+        // #[crate::unstable(
+        //     feature = "ghost-state",
+        //     issue = 3184,
+        //     reason = "experimental ghost state/shadow memory API"
+        // )]
         #[rustc_diagnostic_item = "KaniPointerOffset"]
         #[inline(never)]
-        pub fn pointer_offset<T: ?Sized>(_ptr: *const T) -> usize {
+        pub(crate) fn pointer_offset<T: ?Sized>(_ptr: *const T) -> usize {
             kani_intrinsic()
         }
     };
diff --git a/library/kani_macros/Cargo.toml b/library/kani_macros/Cargo.toml
index e0c79a39c105..5917c322729e 100644
--- a/library/kani_macros/Cargo.toml
+++ b/library/kani_macros/Cargo.toml
@@ -3,7 +3,7 @@
 
 [package]
 name = "kani_macros"
-version = "0.52.0"
+version = "0.53.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 publish = false
diff --git a/library/kani_macros/src/derive.rs b/library/kani_macros/src/derive.rs
index 4e99590fc6a3..a7aaa8ae334e 100644
--- a/library/kani_macros/src/derive.rs
+++ b/library/kani_macros/src/derive.rs
@@ -28,11 +28,30 @@ pub fn expand_derive_arbitrary(item: proc_macro::TokenStream) -> proc_macro::Tok
     let (impl_generics, ty_generics, where_clause) = generics.split_for_impl();
 
     let body = fn_any_body(&item_name, &derive_item.data);
-    let expanded = quote! {
-        // The generated implementation.
-        impl #impl_generics kani::Arbitrary for #item_name #ty_generics #where_clause {
-            fn any() -> Self {
-                #body
+
+    // Get the safety constraints (if any) to produce type-safe values
+    let safety_conds_opt = safety_conds(&item_name, &derive_item.data);
+
+    let expanded = if let Some(safety_cond) = safety_conds_opt {
+        let field_refs = field_refs(&item_name, &derive_item.data);
+        quote! {
+            // The generated implementation.
+            impl #impl_generics kani::Arbitrary for #item_name #ty_generics #where_clause {
+                fn any() -> Self {
+                    let obj = #body;
+                    #field_refs
+                    kani::assume(#safety_cond);
+                    obj
+                }
+            }
+        }
+    } else {
+        quote! {
+            // The generated implementation.
+            impl #impl_generics kani::Arbitrary for #item_name #ty_generics #where_clause {
+                fn any() -> Self {
+                    #body
+                }
             }
         }
     };
@@ -75,6 +94,103 @@ fn fn_any_body(ident: &Ident, data: &Data) -> TokenStream {
     }
 }
 
+/// Parse the condition expressions in `#[safety_constraint(<cond>)]` attached to struct
+/// fields and, it at least one was found, generate a conjunction to be assumed.
+///
+/// For example, if we're deriving implementations for the struct
+/// ```
+/// #[derive(Arbitrary)]
+/// #[derive(Invariant)]
+/// struct PositivePoint {
+///     #[safety_constraint(*x >= 0)]
+///     x: i32,
+///     #[safety_constraint(*y >= 0)]
+///     y: i32,
+/// }
+/// ```
+/// this function will generate the `TokenStream`
+/// ```
+/// *x >= 0 && *y >= 0
+/// ```
+/// which can be passed to `kani::assume` to constrain the values generated
+/// through the `Arbitrary` impl so that they are type-safe by construction.
+fn safety_conds(ident: &Ident, data: &Data) -> Option<TokenStream> {
+    match data {
+        Data::Struct(struct_data) => safety_conds_inner(ident, &struct_data.fields),
+        Data::Enum(_) => None,
+        Data::Union(_) => None,
+    }
+}
+
+/// Generates an expression resulting from the conjunction of conditions
+/// specified as safety constraints for each field. See `safety_conds` for more details.
+fn safety_conds_inner(ident: &Ident, fields: &Fields) -> Option<TokenStream> {
+    match fields {
+        Fields::Named(ref fields) => {
+            let conds: Vec<TokenStream> =
+                fields.named.iter().filter_map(|field| parse_safety_expr(ident, field)).collect();
+            if !conds.is_empty() { Some(quote! { #(#conds)&&* }) } else { None }
+        }
+        Fields::Unnamed(_) => None,
+        Fields::Unit => None,
+    }
+}
+
+/// Generates the sequence of expressions to initialize the variables used as
+/// references to the struct fields.
+///
+/// For example, if we're deriving implementations for the struct
+/// ```
+/// #[derive(Arbitrary)]
+/// #[derive(Invariant)]
+/// struct PositivePoint {
+///     #[safety_constraint(*x >= 0)]
+///     x: i32,
+///     #[safety_constraint(*y >= 0)]
+///     y: i32,
+/// }
+/// ```
+/// this function will generate the `TokenStream`
+/// ```
+/// let x = &obj.x;
+/// let y = &obj.y;
+/// ```
+/// which allows us to refer to the struct fields without using `self`.
+/// Note that the actual stream is generated in the `field_refs_inner` function.
+fn field_refs(ident: &Ident, data: &Data) -> TokenStream {
+    match data {
+        Data::Struct(struct_data) => field_refs_inner(ident, &struct_data.fields),
+        Data::Enum(_) => unreachable!(),
+        Data::Union(_) => unreachable!(),
+    }
+}
+
+/// Generates the sequence of expressions to initialize the variables used as
+/// references to the struct fields. See `field_refs` for more details.
+fn field_refs_inner(_ident: &Ident, fields: &Fields) -> TokenStream {
+    match fields {
+        Fields::Named(ref fields) => {
+            let field_refs: Vec<TokenStream> = fields
+                .named
+                .iter()
+                .map(|field| {
+                    let name = &field.ident;
+                    quote_spanned! {field.span()=>
+                        let #name = &obj.#name;
+                    }
+                })
+                .collect();
+            if !field_refs.is_empty() {
+                quote! { #( #field_refs )* }
+            } else {
+                quote! {}
+            }
+        }
+        Fields::Unnamed(_) => quote! {},
+        Fields::Unit => quote! {},
+    }
+}
+
 /// Generate an item initialization where an item can be a struct or a variant.
 /// For named fields, this will generate: `Item { field1: kani::any(), field2: kani::any(), .. }`
 /// For unnamed fields, this will generate: `Item (kani::any(), kani::any(), ..)`
@@ -115,6 +231,42 @@ fn init_symbolic_item(ident: &Ident, fields: &Fields) -> TokenStream {
     }
 }
 
+/// Extract, parse and return the expression `cond` (i.e., `Some(cond)`) in the
+/// `#[safety_constraint(<cond>)]` attribute helper associated with a given field.
+/// Return `None` if the attribute isn't specified.
+fn parse_safety_expr(ident: &Ident, field: &syn::Field) -> Option<TokenStream> {
+    let name = &field.ident;
+    let mut safety_helper_attr = None;
+
+    // Keep the helper attribute if we find it
+    for attr in &field.attrs {
+        if attr.path().is_ident("safety_constraint") {
+            safety_helper_attr = Some(attr);
+        }
+    }
+
+    // Parse the arguments in the `#[safety_constraint(...)]` attribute
+    if let Some(attr) = safety_helper_attr {
+        let expr_args: Result<syn::Expr, syn::Error> = attr.parse_args();
+
+        // Check if there was an error parsing the arguments
+        if let Err(err) = expr_args {
+            abort!(Span::call_site(), "Cannot derive impl for `{}`", ident;
+            note = attr.span() =>
+            "safety constraint in field `{}` could not be parsed: {}", name.as_ref().unwrap().to_string(), err
+            )
+        }
+
+        // Return the expression associated to the safety constraint
+        let safety_expr = expr_args.unwrap();
+        Some(quote_spanned! {field.span()=>
+            #safety_expr
+        })
+    } else {
+        None
+    }
+}
+
 /// Generate the body of the function `any()` for enums. The cases are:
 /// 1. For zero-variants enumerations, this will encode a `panic!()` statement.
 /// 2. For one or more variants, the code will be something like:
@@ -176,10 +328,14 @@ pub fn expand_derive_invariant(item: proc_macro::TokenStream) -> proc_macro::Tok
     let (impl_generics, ty_generics, where_clause) = generics.split_for_impl();
 
     let body = is_safe_body(&item_name, &derive_item.data);
+    let field_refs = field_refs(&item_name, &derive_item.data);
+
     let expanded = quote! {
         // The generated implementation.
         impl #impl_generics kani::Invariant for #item_name #ty_generics #where_clause {
             fn is_safe(&self) -> bool {
+                let obj = self;
+                #field_refs
                 #body
             }
         }
@@ -199,7 +355,7 @@ fn add_trait_bound_invariant(mut generics: Generics) -> Generics {
 
 fn is_safe_body(ident: &Ident, data: &Data) -> TokenStream {
     match data {
-        Data::Struct(struct_data) => struct_safe_conjunction(ident, &struct_data.fields),
+        Data::Struct(struct_data) => struct_invariant_conjunction(ident, &struct_data.fields),
         Data::Enum(_) => {
             abort!(Span::call_site(), "Cannot derive `Invariant` for `{}` enum", ident;
                 note = ident.span() =>
@@ -215,21 +371,35 @@ fn is_safe_body(ident: &Ident, data: &Data) -> TokenStream {
     }
 }
 
-/// Generates an expression that is the conjunction of `is_safe` calls for each field in the struct.
-fn struct_safe_conjunction(_ident: &Ident, fields: &Fields) -> TokenStream {
+/// Generates an expression that is the conjunction of safety constraints for each field in the struct.
+fn struct_invariant_conjunction(ident: &Ident, fields: &Fields) -> TokenStream {
     match fields {
         // Expands to the expression
+        // `true && <safety_cond1> && <safety_cond2> && ..`
+        // where `safety_condN` is
+        //  - `self.fieldN.is_safe() && <cond>` if a condition `<cond>` was
+        //    specified through the `#[safety_constraint(<cond>)]` helper attribute, or
+        //  - `self.fieldN.is_safe()` otherwise
+        //
+        // Therefore, if `#[safety_constraint(<cond>)]` isn't specified for any field, this expands to
         // `true && self.field1.is_safe() && self.field2.is_safe() && ..`
         Fields::Named(ref fields) => {
-            let safe_calls = fields.named.iter().map(|field| {
-                let name = &field.ident;
-                quote_spanned! {field.span()=>
-                    self.#name.is_safe()
-                }
-            });
+            let safety_conds: Vec<TokenStream> = fields
+                .named
+                .iter()
+                .map(|field| {
+                    let name = &field.ident;
+                    let default_expr = quote_spanned! {field.span()=>
+                        #name.is_safe()
+                    };
+                    parse_safety_expr(ident, field)
+                        .map(|expr| quote! { #expr && #default_expr})
+                        .unwrap_or(default_expr)
+                })
+                .collect();
             // An initial value is required for empty structs
-            safe_calls.fold(quote! { true }, |acc, call| {
-                quote! { #acc && #call }
+            safety_conds.iter().fold(quote! { true }, |acc, cond| {
+                quote! { #acc && #cond }
             })
         }
         Fields::Unnamed(ref fields) => {
diff --git a/library/kani_macros/src/lib.rs b/library/kani_macros/src/lib.rs
index b10b8a74cdc5..4e3a8d6f9f5b 100644
--- a/library/kani_macros/src/lib.rs
+++ b/library/kani_macros/src/lib.rs
@@ -100,16 +100,120 @@ pub fn unstable_feature(attr: TokenStream, item: TokenStream) -> TokenStream {
     attr_impl::unstable(attr, item)
 }
 
-/// Allow users to auto generate Arbitrary implementations by using `#[derive(Arbitrary)]` macro.
+/// Allow users to auto generate `Arbitrary` implementations by using
+/// `#[derive(Arbitrary)]` macro.
+///
+/// When using `#[derive(Arbitrary)]` on a struct, the `#[safety_constraint(<cond>)]`
+/// attribute can be added to its fields to indicate a type safety invariant
+/// condition `<cond>`. Since `kani::any()` is always expected to produce
+/// type-safe values, **adding `#[safety_constraint(...)]` to any fields will further
+/// constrain the objects generated with `kani::any()`**.
+///
+/// For example, the `check_positive` harness in this code is expected to
+/// pass:
+///
+/// ```rs
+/// #[derive(kani::Arbitrary)]
+/// struct AlwaysPositive {
+///     #[safety_constraint(*inner >= 0)]
+///     inner: i32,
+/// }
+///
+/// #[kani::proof]
+/// fn check_positive() {
+///     let val: AlwaysPositive = kani::any();
+///     assert!(val.inner >= 0);
+/// }
+/// ```
+///
+/// Therefore, using the `#[safety_constraint(...)]` attribute can lead to vacuous
+/// results when the values are over-constrained. For example, in this code
+/// the `check_positive` harness will pass too:
+///
+/// ```rs
+/// #[derive(kani::Arbitrary)]
+/// struct AlwaysPositive {
+///     #[safety_constraint(*inner >= 0 && *inner < i32::MIN)]
+///     inner: i32,
+/// }
+///
+/// #[kani::proof]
+/// fn check_positive() {
+///     let val: AlwaysPositive = kani::any();
+///     assert!(val.inner >= 0);
+/// }
+/// ```
+///
+/// Unfortunately, we made a mistake when specifying the condition because
+/// `*inner >= 0 && *inner < i32::MIN` is equivalent to `false`. This results
+/// in the relevant assertion being unreachable:
+///
+/// ```
+/// Check 1: check_positive.assertion.1
+///         - Status: UNREACHABLE
+///         - Description: "assertion failed: val.inner >= 0"
+///         - Location: src/main.rs:22:5 in function check_positive
+/// ```
+///
+/// As usual, we recommend users to defend against these behaviors by using
+/// `kani::cover!(...)` checks and watching out for unreachable assertions in
+/// their project's code.
 #[proc_macro_error]
-#[proc_macro_derive(Arbitrary)]
+#[proc_macro_derive(Arbitrary, attributes(safety_constraint))]
 pub fn derive_arbitrary(item: TokenStream) -> TokenStream {
     derive::expand_derive_arbitrary(item)
 }
 
-/// Allow users to auto generate Invariant implementations by using `#[derive(Invariant)]` macro.
+/// Allow users to auto generate `Invariant` implementations by using
+/// `#[derive(Invariant)]` macro.
+///
+/// When using `#[derive(Invariant)]` on a struct, the `#[safety_constraint(<cond>)]`
+/// attribute can be added to its fields to indicate a type safety invariant
+/// condition `<cond>`. This will ensure that the gets additionally checked when
+/// using the `is_safe()` method generated by the `#[derive(Invariant)]` macro.
+///
+/// For example, the `check_positive` harness in this code is expected to
+/// fail:
+///
+/// ```rs
+/// #[derive(kani::Invariant)]
+/// struct AlwaysPositive {
+///     #[safety_constraint(*inner >= 0)]
+///     inner: i32,
+/// }
+///
+/// #[kani::proof]
+/// fn check_positive() {
+///     let val = AlwaysPositive { inner: -1 };
+///     assert!(val.is_safe());
+/// }
+/// ```
+///
+/// This is not too surprising since the type safety invariant that we indicated
+/// is not being taken into account when we create the `AlwaysPositive` object.
+///
+/// As mentioned, the `is_safe()` methods generated by the
+/// `#[derive(Invariant)]` macro check the corresponding `is_safe()` method for
+/// each field in addition to any type safety invariants specified through the
+/// `#[safety_constraint(...)]` attribute.
+///
+/// For example, for the `AlwaysPositive` struct from above, we will generate
+/// the following implementation:
+///
+/// ```rs
+/// impl kani::Invariant for AlwaysPositive {
+///     fn is_safe(&self) -> bool {
+///         let obj = self;
+///         let inner = &obj.inner;
+///         true && *inner >= 0 && inner.is_safe()
+///     }
+/// }
+/// ```
+///
+/// Note: the assignments to `obj` and `inner` are made so that we can treat the
+/// fields as if they were references.
 #[proc_macro_error]
-#[proc_macro_derive(Invariant)]
+#[proc_macro_derive(Invariant, attributes(safety_constraint))]
 pub fn derive_invariant(item: TokenStream) -> TokenStream {
     derive::expand_derive_invariant(item)
 }
diff --git a/library/kani_macros/src/sysroot/contracts/check.rs b/library/kani_macros/src/sysroot/contracts/check.rs
index e76286b398cb..f804fc70c5f5 100644
--- a/library/kani_macros/src/sysroot/contracts/check.rs
+++ b/library/kani_macros/src/sysroot/contracts/check.rs
@@ -156,11 +156,19 @@ impl<'a> ContractConditionsHandler<'a> {
             let sig = &mut self.annotated_fn.sig;
             for (arg, arg_type) in wrapper_args.clone().zip(type_params) {
                 // Add the type parameter to the function signature's generic parameters list
+                let mut bounds: syn::punctuated::Punctuated<syn::TypeParamBound, syn::token::Plus> =
+                    syn::punctuated::Punctuated::new();
+                bounds.push(syn::TypeParamBound::Trait(syn::TraitBound {
+                    paren_token: None,
+                    modifier: syn::TraitBoundModifier::Maybe(Token![?](Span::call_site())),
+                    lifetimes: None,
+                    path: syn::Ident::new("Sized", Span::call_site()).into(),
+                }));
                 sig.generics.params.push(syn::GenericParam::Type(syn::TypeParam {
                     attrs: vec![],
                     ident: arg_type.clone(),
-                    colon_token: None,
-                    bounds: Default::default(),
+                    colon_token: Some(Token![:](Span::call_site())),
+                    bounds: bounds,
                     eq_token: None,
                     default: None,
                 }));
diff --git a/library/kani_macros/src/sysroot/contracts/replace.rs b/library/kani_macros/src/sysroot/contracts/replace.rs
index 7a522ea98e08..280839dcafca 100644
--- a/library/kani_macros/src/sysroot/contracts/replace.rs
+++ b/library/kani_macros/src/sysroot/contracts/replace.rs
@@ -94,7 +94,7 @@ impl<'a> ContractConditionsHandler<'a> {
                 let result = Ident::new(INTERNAL_RESULT_IDENT, Span::call_site());
                 quote!(
                     #(#before)*
-                    #(*unsafe { kani::internal::Pointer::assignable(kani::internal::untracked_deref(&(#attr))) } = kani::any_modifies();)*
+                    #(unsafe{kani::internal::write_any(kani::internal::Pointer::assignable(kani::internal::untracked_deref(&#attr)))};)*
                     #(#after)*
                     #result
                 )
diff --git a/library/kani_macros/src/sysroot/contracts/shared.rs b/library/kani_macros/src/sysroot/contracts/shared.rs
index 2682c0781661..1ab791d9a117 100644
--- a/library/kani_macros/src/sysroot/contracts/shared.rs
+++ b/library/kani_macros/src/sysroot/contracts/shared.rs
@@ -176,7 +176,7 @@ pub fn build_ensures(data: &ExprClosure) -> (TokenStream2, Expr) {
         .fold(quote!(), |collect, (ident, expr)| quote!(let #ident = #expr; #collect));
 
     let result: Ident = Ident::new(INTERNAL_RESULT_IDENT, Span::call_site());
-    (remembers_stmts, Expr::Verbatim(quote!((#expr)(&#result))))
+    (remembers_stmts, Expr::Verbatim(quote!(kani::internal::apply_closure(#expr, &#result))))
 }
 
 trait OldTrigger {
diff --git a/library/std/Cargo.toml b/library/std/Cargo.toml
index fcc2739dc606..ae70767f6781 100644
--- a/library/std/Cargo.toml
+++ b/library/std/Cargo.toml
@@ -5,7 +5,7 @@
 # Note: this package is intentionally named std to make sure the names of
 # standard library symbols are preserved
 name = "std"
-version = "0.52.0"
+version = "0.53.0"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 publish = false
diff --git a/rfc/src/SUMMARY.md b/rfc/src/SUMMARY.md
index f8d5dc5639f5..e0b31761ae62 100644
--- a/rfc/src/SUMMARY.md
+++ b/rfc/src/SUMMARY.md
@@ -15,3 +15,4 @@
 - [0007-global-conditions](rfcs/0007-global-conditions.md)
 - [0008-line-coverage](rfcs/0008-line-coverage.md)
 - [0009-function-contracts](rfcs/0009-function-contracts.md)
+- [0010-quantifiers](rfcs/0010-quantifiers.md)
diff --git a/rfc/src/rfcs/0010-quantifiers.md b/rfc/src/rfcs/0010-quantifiers.md
new file mode 100644
index 000000000000..07a5f7548974
--- /dev/null
+++ b/rfc/src/rfcs/0010-quantifiers.md
@@ -0,0 +1,203 @@
+- **Feature Name:** Quantifiers
+- **Feature Request Issue:** [#2546](https://github.com/model-checking/kani/issues/2546) and [#836](https://github.com/model-checking/kani/issues/836)
+- **RFC PR:** [#](https://github.com/model-checking/kani/pull/)
+- **Status:** Unstable
+- **Version:** 1.0
+
+-------------------
+
+## Summary
+
+Quantifiers are logical operators that allow users to express that a property or condition applies to some or all objects within a given domain.
+
+## User Impact
+
+There are two primary quantifiers: the existential quantifier (∃) and the universal quantifier (∀).
+
+1. The existential quantifier (∃): represents the statement "there exists." We use to express that there is at least one object in the domain that satisfies a given condition. For example, "∃x P(x)" means "there exists a value x such that P(x) is true."
+
+2. The universal quantifier (∀): represents the statement "for all" or "for every." We use it to express that a given condition is true for every object in the domain. For example, "∀x P(x)" means "for every value x, P(x) is true."
+
+Rather than exhaustively listing all elements in a domain, quantifiers enable users to make statements about the entire domain at once. This compact representation is crucial when dealing with large or unbounded inputs. Quantifiers also facilitate abstraction and generalization of properties. Instead of specifying properties for specific instances, quantified properties can capture general patterns and behaviors that hold across different objects in a domain. Additionally, by replacing loops in the specification with quantifiers, Kani can encode the properties more efficiently within the specified bounds, making the verification process more manageable and computationally feasible.
+
+This new feature doesn't introduce any breaking changes to users. It will only allow them to write properites using the existential (∃) and universal (∀) quantifiers.
+
+## User Experience
+
+We propose a syntax inspired by ["Pattern Types"](https://github.com/rust-lang/rust/pull/120131). The syntax of existential (i.e., `kani::exists`) and universal (i.e., `kani::forall`) quantifiers are:
+
+```rust
+kani::exists(|<var>: <type> [is <range-expr>] | <boolean-expression>)
+kani::forall(|<var>: <type> [is <range-expr>] | <boolean-expression>)
+```
+
+If `<range-expr>` is not provided, we assume `<var>` can range over all possible values of the given `<type>` (i.e., syntactic sugar for full range `|<var>: <type> as .. |`). CBMC's SAT backend only supports bounded quantification under **constant** lower and upper bounds (for more details, see the [documentation for quantifiers in CBMC](https://diffblue.github.io/cbmc/contracts-quantifiers.html)). The SMT backend, on the other hand, supports arbitrary Boolean expressions. In any case, `<boolean-expression>` should not have side effects, as the purpose of quantifiers is to assert a condition over a domain of objects without altering the state.
+
+Consider the following example adapted from the documentation for the [from_raw_parts](https://doc.rust-lang.org/std/vec/struct.Vec.html#method.from_raw_parts) function:
+
+```rust
+use std::ptr;
+use std::mem;
+
+#[kani::proof]
+fn main() {
+    let v = vec![kani::any::<usize>(); 100];
+
+    // Prevent running `v`'s destructor so we are in complete control
+    // of the allocation.
+    let mut v = mem::ManuallyDrop::new(v);
+
+    // Pull out the various important pieces of information about `v`
+    let p = v.as_mut_ptr();
+    let len = v.len();
+    let cap = v.capacity();
+
+    unsafe {
+        // Overwrite memory
+        for i in 0..len {
+            *p.add(i) += 1;
+        }
+
+        // Put everything back together into a Vec
+        let rebuilt = Vec::from_raw_parts(p, len, cap);
+    }
+}
+```
+
+Given the `v` vector has non-deterministic values, there are potential arithmetic overflows that might happen in the for loop. So we need to constrain all values of the array. We may also want to check all values of `rebuilt` after the operation. Without quantifiers, we might be tempted to use loops as follows:
+
+```rust
+use std::ptr;
+use std::mem;
+
+#[kani::proof]
+fn main() {
+    let original_v = vec![kani::any::<usize>(); 100];
+    let v = original_v.clone();
+    for i in 0..v.len() {
+        kani::assume(v[i] < 5);
+    }
+
+    // Prevent running `v`'s destructor so we are in complete control
+    // of the allocation.
+    let mut v = mem::ManuallyDrop::new(v);
+
+    // Pull out the various important pieces of information about `v`
+    let p = v.as_mut_ptr();
+    let len = v.len();
+    let cap = v.capacity();
+
+    unsafe {
+        // Overwrite memory
+        for i in 0..len {
+            *p.add(i) += 1;
+        }
+
+        // Put everything back together into a Vec
+        let rebuilt = Vec::from_raw_parts(p, len, cap);
+        for i in 0..len {
+            assert_eq!(rebuilt[i], original_v[i]+1);
+        }
+    }
+}
+```
+
+This, however, might unnecessary increase the complexity of the verication process. We can achieve the same effect using quantifiers as shown below.
+
+```rust
+use std::ptr;
+use std::mem;
+
+#[kani::proof]
+fn main() {
+    let original_v = vec![kani::any::<usize>(); 3];
+    let v = original_v.clone();
+    kani::assume(kani::forall(|i: usize is ..v.len() | v[i] < 5));
+
+    // Prevent running `v`'s destructor so we are in complete control
+    // of the allocation.
+    let mut v = mem::ManuallyDrop::new(v);
+
+    // Pull out the various important pieces of information about `v`
+    let p = v.as_mut_ptr();
+    let len = v.len();
+    let cap = v.capacity();
+
+    unsafe {
+        // Overwrite memory
+        for i in 0..len {
+            *p.add(i) += 1;
+        }
+
+        // Put everything back together into a Vec
+        let rebuilt = Vec::from_raw_parts(p, len, cap);
+        assert!(kani::forall(|i: usize is ..len | rebuilt[i] == original_v[i]+1));
+    }
+}
+```
+
+The same principle applies if we want to use the existential quantifier.
+
+```rust
+use std::ptr;
+use std::mem;
+
+#[kani::proof]
+fn main() {
+    let original_v = vec![kani::any::<usize>(); 3];
+    let v = original_v.clone();
+    kani::assume(kani::forall(|i: usize is ..v.len() | v[i] < 5));
+
+    // Prevent running `v`'s destructor so we are in complete control
+    // of the allocation.
+    let mut v = mem::ManuallyDrop::new(v);
+
+    // Pull out the various important pieces of information about `v`
+    let p = v.as_mut_ptr();
+    let len = v.len();
+    let cap = v.capacity();
+
+    unsafe {
+        // Overwrite memory
+        for i in 0..len {
+            *p.add(i) += 1;
+            if i == 1 {
+              *p.add(i) = 0;
+            }
+        }
+
+        // Put everything back together into a Vec
+        let rebuilt = Vec::from_raw_parts(p, len, cap);
+        assert!(kani::exists(|i: usize is ..len | rebuilt[i] == 0));
+    }
+}
+```
+
+The usage of quantifiers should be valid in any part of the Rust code analysed by Kani.
+
+## Detailed Design
+
+<!-- For the implementors or the hackers -->
+
+Kani should have the same support that CBMC has for quantifiers. For more details, see [Quantifiers](https://github.com/diffblue/cbmc/blob/0a69a64e4481473d62496f9975730d24f194884a/doc/cprover-manual/contracts-quantifiers.md).
+
+
+## Open questions
+
+<!-- For Developers -->
+- **Function Contracts RFC** - CBMC has support for both `exists` and `forall`, but the
+  code generation is difficult. The most ergonomic and easy way to implement
+  quantifiers on the Rust side is as higher-order functions taking `Fn(T) ->
+  bool`, where `T` is some arbitrary type that can be quantified over. This
+  interface is familiar to developers, but the code generation is tricky, as
+  CBMC level quantifiers only allow certain kinds of expressions. This
+  necessitates a rewrite of the `Fn` closure to a compliant expression.
+    - Which kind of expressions should be accepted as a "compliant expression"? 
+
+
+## Future possibilities
+
+<!-- For Developers -->
+- CBMC has an SMT backend which allows the use of quantifiers with arbitrary Boolean expressions. Kani must include an option for users to experiment with this backend.
+
+---
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index fb354883739f..27c29bb820e2 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -2,5 +2,5 @@
 # SPDX-License-Identifier: Apache-2.0 OR MIT
 
 [toolchain]
-channel = "nightly-2024-06-23"
+channel = "nightly-2024-07-21"
 components = ["llvm-tools", "rustc-dev", "rust-src", "rustfmt"]
diff --git a/tests/cargo-ui/stubbing-flag/src/main.rs b/tests/cargo-ui/stubbing-flag/src/main.rs
index db26e366005e..1ef312b852ff 100644
--- a/tests/cargo-ui/stubbing-flag/src/main.rs
+++ b/tests/cargo-ui/stubbing-flag/src/main.rs
@@ -1,7 +1,8 @@
 // Copyright Kani Contributors
 // SPDX-License-Identifier: Apache-2.0 OR MIT
 //
-//! This tests that the `--enable-stubbing` and `--harness` arguments flow from `kani-driver` to `kani-compiler`.
+//! This tests that enabling stubbing and using `--harness` arguments flow from
+//! `kani-driver` to `kani-compiler`.
 
 #[kani::proof]
 fn main() {}
diff --git a/tests/expected/arbitrary/floats/non_standard_floats/expected b/tests/expected/arbitrary/floats/non_standard_floats/expected
new file mode 100644
index 000000000000..26db615201a6
--- /dev/null
+++ b/tests/expected/arbitrary/floats/non_standard_floats/expected
@@ -0,0 +1,31 @@
+Checking harness check_f128...
+
+Status: SATISFIED\
+Description: "This may be true"\
+in function check_f128
+
+Status: SATISFIED\
+Description: "This may also be true"\
+in function check_f128
+
+Status: SATISFIED\
+Description: "NaN should be valid float"\
+in function check_f128
+
+Checking harness check_f16...
+
+Status: SATISFIED\
+Description: "This may be true"\
+in function check_f16
+
+Status: SATISFIED\
+Description: "This may also be true"\
+in function check_f16
+
+Status: SATISFIED\
+Description: "NaN should be valid float"\
+in function check_f16
+
+VERIFICATION:- SUCCESSFUL
+
+Complete - 2 successfully verified harnesses, 0 failures, 2 total.
diff --git a/tests/expected/arbitrary/floats/non_standard_floats/main.rs b/tests/expected/arbitrary/floats/non_standard_floats/main.rs
new file mode 100644
index 000000000000..ebea6535b3d5
--- /dev/null
+++ b/tests/expected/arbitrary/floats/non_standard_floats/main.rs
@@ -0,0 +1,27 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+//
+// Ensure that kani::any and kani::any_raw can be used with non-standard floats i.e f16 and f128.
+
+#![feature(f16)]
+#![feature(f128)]
+
+macro_rules! test_non_standard_floats {
+    ( $type: ty ) => {{
+        let v1 = kani::any::<$type>();
+        let v2 = kani::any::<$type>();
+        kani::cover!(v1 == v2, "This may be true");
+        kani::cover!(v1 != v2, "This may also be true");
+        kani::cover!(v1.is_nan(), "NaN should be valid float");
+    }};
+}
+
+#[kani::proof]
+fn check_f16() {
+    test_non_standard_floats!(f16);
+}
+
+#[kani::proof]
+fn check_f128() {
+    test_non_standard_floats!(f128);
+}
diff --git a/tests/expected/arbitrary/floats/expected b/tests/expected/arbitrary/floats/standard_floats/expected
similarity index 99%
rename from tests/expected/arbitrary/floats/expected
rename to tests/expected/arbitrary/floats/standard_floats/expected
index 4bb2fadacd7f..de3b67f28578 100644
--- a/tests/expected/arbitrary/floats/expected
+++ b/tests/expected/arbitrary/floats/standard_floats/expected
@@ -51,10 +51,8 @@ Status: SATISFIED\
 Description: "Non-finite numbers are valid float"\
 in function check_f32
 
-
  ** 6 of 6 cover properties satisfied
 
-
 VERIFICATION:- SUCCESSFUL
 
 Complete - 2 successfully verified harnesses, 0 failures, 2 total.
diff --git a/tests/expected/arbitrary/floats/main.rs b/tests/expected/arbitrary/floats/standard_floats/main.rs
similarity index 74%
rename from tests/expected/arbitrary/floats/main.rs
rename to tests/expected/arbitrary/floats/standard_floats/main.rs
index 1ad4de3ef3f7..c204643e9ab8 100644
--- a/tests/expected/arbitrary/floats/main.rs
+++ b/tests/expected/arbitrary/floats/standard_floats/main.rs
@@ -1,9 +1,12 @@
 // Copyright Kani Contributors
 // SPDX-License-Identifier: Apache-2.0 OR MIT
 //
-// Ensure that kani::any and kani::any_raw can be used with floats.
+// Ensure that kani::any and kani::any_raw can be used with standard floats i.e f32 and f64.
 
-macro_rules! test {
+#![feature(f16)]
+#![feature(f128)]
+
+macro_rules! test_standard_floats {
     ( $type: ty ) => {{
         let v1 = kani::any::<$type>();
         let v2 = kani::any::<$type>();
@@ -18,10 +21,10 @@ macro_rules! test {
 
 #[kani::proof]
 fn check_f32() {
-    test!(f32);
+    test_standard_floats!(f32);
 }
 
 #[kani::proof]
 fn check_f64() {
-    test!(f64);
+    test_standard_floats!(f64);
 }
diff --git a/tests/expected/derive-arbitrary/safety_constraint_helper/expected b/tests/expected/derive-arbitrary/safety_constraint_helper/expected
new file mode 100644
index 000000000000..f35f18084911
--- /dev/null
+++ b/tests/expected/derive-arbitrary/safety_constraint_helper/expected
@@ -0,0 +1,17 @@
+Check 1: check_invariant_helper_ok.assertion.1\
+         - Status: SUCCESS\
+         - Description: "assertion failed: pos_point.x >= 0"
+
+Check 2: check_invariant_helper_ok.assertion.2\
+         - Status: SUCCESS\
+         - Description: "assertion failed: pos_point.y >= 0"
+
+Check 1: check_invariant_helper_fail.assertion.1\
+         - Status: FAILURE\
+         - Description: "assertion failed: pos_point.x >= 0"
+
+Check 2: check_invariant_helper_fail.assertion.2\
+         - Status: FAILURE\
+         - Description: "assertion failed: pos_point.y >= 0"
+
+Complete - 2 successfully verified harnesses, 0 failures, 2 total.
diff --git a/tests/expected/derive-arbitrary/safety_constraint_helper/safety_constraint_helper.rs b/tests/expected/derive-arbitrary/safety_constraint_helper/safety_constraint_helper.rs
new file mode 100644
index 000000000000..5b608aa2a3c0
--- /dev/null
+++ b/tests/expected/derive-arbitrary/safety_constraint_helper/safety_constraint_helper.rs
@@ -0,0 +1,31 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Check that the `#[safety_constraint(...)]` attribute helper adds the conditions provided to
+//! the attribute to the derived `Arbitrary` implementation.
+
+extern crate kani;
+use kani::Invariant;
+
+#[derive(kani::Arbitrary)]
+struct PositivePoint {
+    #[safety_constraint(*x >= 0)]
+    x: i32,
+    #[safety_constraint(*y >= 0)]
+    y: i32,
+}
+
+#[kani::proof]
+fn check_invariant_helper_ok() {
+    let pos_point: PositivePoint = kani::any();
+    assert!(pos_point.x >= 0);
+    assert!(pos_point.y >= 0);
+}
+
+#[kani::proof]
+#[kani::should_panic]
+fn check_invariant_helper_fail() {
+    let pos_point: PositivePoint = PositivePoint { x: kani::any(), y: kani::any() };
+    assert!(pos_point.x >= 0);
+    assert!(pos_point.y >= 0);
+}
diff --git a/tests/expected/derive-invariant/attrs_cfg_guard/attrs_cfg_guard.rs b/tests/expected/derive-invariant/attrs_cfg_guard/attrs_cfg_guard.rs
new file mode 100644
index 000000000000..546695bf3731
--- /dev/null
+++ b/tests/expected/derive-invariant/attrs_cfg_guard/attrs_cfg_guard.rs
@@ -0,0 +1,24 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Check that the `#[safety_constraint(...)]` attribute helper is picked up
+//! when it's used with `cfg_attr(kani, ...)]`.
+
+extern crate kani;
+use kani::Invariant;
+
+#[derive(kani::Arbitrary)]
+#[derive(kani::Invariant)]
+struct PositivePoint {
+    #[cfg_attr(kani, safety_constraint(*x >= 0))]
+    x: i32,
+    #[cfg_attr(kani, safety_constraint(*y >= 0))]
+    y: i32,
+}
+
+#[kani::proof]
+fn check_safety_constraint_cfg() {
+    let pos_point: PositivePoint = kani::any();
+    assert!(pos_point.x >= 0);
+    assert!(pos_point.y >= 0);
+}
diff --git a/tests/expected/derive-invariant/attrs_cfg_guard/expected b/tests/expected/derive-invariant/attrs_cfg_guard/expected
new file mode 100644
index 000000000000..edb3e256975d
--- /dev/null
+++ b/tests/expected/derive-invariant/attrs_cfg_guard/expected
@@ -0,0 +1,9 @@
+Check 1: check_safety_constraint_cfg.assertion.1\
+         - Status: SUCCESS\
+         - Description: "assertion failed: pos_point.x >= 0"
+
+Check 2: check_safety_constraint_cfg.assertion.2\
+         - Status: SUCCESS\
+         - Description: "assertion failed: pos_point.y >= 0"
+
+Complete - 1 successfully verified harnesses, 0 failures, 1 total.
diff --git a/tests/expected/derive-invariant/attrs_mixed/attrs_mixed.rs b/tests/expected/derive-invariant/attrs_mixed/attrs_mixed.rs
new file mode 100644
index 000000000000..ff58ff846c67
--- /dev/null
+++ b/tests/expected/derive-invariant/attrs_mixed/attrs_mixed.rs
@@ -0,0 +1,24 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Check that in the `#[safety_constraint(...)]` attribute helper it is
+//! possible to refer to other struct fields, not just the one associated with
+//! the attribute.
+
+extern crate kani;
+use kani::Invariant;
+
+#[derive(kani::Arbitrary)]
+#[derive(kani::Invariant)]
+struct PositivePoint {
+    #[safety_constraint(*x >= 0 && *y >= 0)]
+    x: i32,
+    y: i32,
+}
+
+#[kani::proof]
+fn check_safety_constraint_cfg() {
+    let pos_point: PositivePoint = kani::any();
+    assert!(pos_point.x >= 0);
+    assert!(pos_point.y >= 0);
+}
diff --git a/tests/expected/derive-invariant/attrs_mixed/expected b/tests/expected/derive-invariant/attrs_mixed/expected
new file mode 100644
index 000000000000..edb3e256975d
--- /dev/null
+++ b/tests/expected/derive-invariant/attrs_mixed/expected
@@ -0,0 +1,9 @@
+Check 1: check_safety_constraint_cfg.assertion.1\
+         - Status: SUCCESS\
+         - Description: "assertion failed: pos_point.x >= 0"
+
+Check 2: check_safety_constraint_cfg.assertion.2\
+         - Status: SUCCESS\
+         - Description: "assertion failed: pos_point.y >= 0"
+
+Complete - 1 successfully verified harnesses, 0 failures, 1 total.
diff --git a/tests/expected/derive-invariant/safety_constraint_helper/expected b/tests/expected/derive-invariant/safety_constraint_helper/expected
new file mode 100644
index 000000000000..31b6de54c647
--- /dev/null
+++ b/tests/expected/derive-invariant/safety_constraint_helper/expected
@@ -0,0 +1,13 @@
+Check 1: check_invariant_helper_ok.assertion.1\
+         - Status: SUCCESS\
+         - Description: "assertion failed: pos_point.is_safe()"
+
+Check 1: check_invariant_helper_ok_manual.assertion.1\
+         - Status: SUCCESS\
+         - Description: "assertion failed: pos_point.is_safe()"
+
+Check 1: check_invariant_helper_fail.assertion.1\
+         - Status: FAILURE\
+         - Description: "assertion failed: pos_point.is_safe()"
+
+Complete - 3 successfully verified harnesses, 0 failures, 3 total.
diff --git a/tests/expected/derive-invariant/safety_constraint_helper/safety_constraint_helper.rs b/tests/expected/derive-invariant/safety_constraint_helper/safety_constraint_helper.rs
new file mode 100644
index 000000000000..44a218f8fa63
--- /dev/null
+++ b/tests/expected/derive-invariant/safety_constraint_helper/safety_constraint_helper.rs
@@ -0,0 +1,43 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Check that the `#[safety_constraint(...)]` attribute helper adds the conditions provided to
+//! the attribute to the derived `Invariant` implementation.
+
+extern crate kani;
+use kani::Invariant;
+
+#[derive(kani::Arbitrary)]
+#[derive(kani::Invariant)]
+struct PositivePoint {
+    #[safety_constraint(*x >= 0)]
+    x: i32,
+    #[safety_constraint(*y >= 0)]
+    y: i32,
+}
+
+#[kani::proof]
+fn check_invariant_helper_ok() {
+    let pos_point: PositivePoint = kani::any();
+    assert!(pos_point.is_safe());
+}
+
+#[kani::proof]
+#[kani::should_panic]
+fn check_invariant_helper_fail() {
+    // In this case, we build the struct from unconstrained arbitrary values
+    // that do not respect `PositivePoint`'s safety constraints.
+    let pos_point: PositivePoint = PositivePoint { x: kani::any(), y: kani::any() };
+    assert!(pos_point.is_safe());
+}
+
+#[kani::proof]
+fn check_invariant_helper_ok_manual() {
+    // In this case, we build the struct from unconstrained arbitrary values
+    // that do not respect `PositivePoint`'s safety constraints. However, we
+    // manually constrain them later.
+    let pos_point: PositivePoint = PositivePoint { x: kani::any(), y: kani::any() };
+    kani::assume(pos_point.x >= 0);
+    kani::assume(pos_point.y >= 0);
+    assert!(pos_point.is_safe());
+}
diff --git a/tests/expected/derive-invariant/safety_constraint_helper_funs/expected b/tests/expected/derive-invariant/safety_constraint_helper_funs/expected
new file mode 100644
index 000000000000..31b6de54c647
--- /dev/null
+++ b/tests/expected/derive-invariant/safety_constraint_helper_funs/expected
@@ -0,0 +1,13 @@
+Check 1: check_invariant_helper_ok.assertion.1\
+         - Status: SUCCESS\
+         - Description: "assertion failed: pos_point.is_safe()"
+
+Check 1: check_invariant_helper_ok_manual.assertion.1\
+         - Status: SUCCESS\
+         - Description: "assertion failed: pos_point.is_safe()"
+
+Check 1: check_invariant_helper_fail.assertion.1\
+         - Status: FAILURE\
+         - Description: "assertion failed: pos_point.is_safe()"
+
+Complete - 3 successfully verified harnesses, 0 failures, 3 total.
diff --git a/tests/expected/derive-invariant/safety_constraint_helper_funs/safety_constraint_helper_funs.rs b/tests/expected/derive-invariant/safety_constraint_helper_funs/safety_constraint_helper_funs.rs
new file mode 100644
index 000000000000..a2c4600eb208
--- /dev/null
+++ b/tests/expected/derive-invariant/safety_constraint_helper_funs/safety_constraint_helper_funs.rs
@@ -0,0 +1,48 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Check that functions can be called in the `#[safety_constraint(...)]` attribute helpers.
+//! This is like the `invariant_helper` test but using a function instead
+//! of passing in a predicate.
+
+extern crate kani;
+use kani::Invariant;
+
+#[derive(kani::Arbitrary)]
+#[derive(kani::Invariant)]
+struct PositivePoint {
+    #[safety_constraint(is_coordinate_safe(x))]
+    x: i32,
+    #[safety_constraint(is_coordinate_safe(y))]
+    y: i32,
+}
+
+fn is_coordinate_safe(val: &i32) -> bool {
+    *val >= 0
+}
+
+#[kani::proof]
+fn check_invariant_helper_ok() {
+    let pos_point: PositivePoint = kani::any();
+    assert!(pos_point.is_safe());
+}
+
+#[kani::proof]
+#[kani::should_panic]
+fn check_invariant_helper_fail() {
+    // In this case, we build the struct from unconstrained arbitrary values
+    // that do not respect `PositivePoint`'s safety constraints.
+    let pos_point: PositivePoint = PositivePoint { x: kani::any(), y: kani::any() };
+    assert!(pos_point.is_safe());
+}
+
+#[kani::proof]
+fn check_invariant_helper_ok_manual() {
+    // In this case, we build the struct from unconstrained arbitrary values
+    // that do not respect `PositivePoint`'s safety constraints. However, we
+    // manually constrain them later.
+    let pos_point: PositivePoint = PositivePoint { x: kani::any(), y: kani::any() };
+    kani::assume(pos_point.x >= 0);
+    kani::assume(pos_point.y >= 0);
+    assert!(pos_point.is_safe());
+}
diff --git a/tests/expected/derive-invariant/invariant_fail/expected b/tests/expected/derive-invariant/safety_invariant_fail/expected
similarity index 100%
rename from tests/expected/derive-invariant/invariant_fail/expected
rename to tests/expected/derive-invariant/safety_invariant_fail/expected
diff --git a/tests/expected/derive-invariant/invariant_fail/invariant_fail.rs b/tests/expected/derive-invariant/safety_invariant_fail/safety_invariant_fail.rs
similarity index 100%
rename from tests/expected/derive-invariant/invariant_fail/invariant_fail.rs
rename to tests/expected/derive-invariant/safety_invariant_fail/safety_invariant_fail.rs
diff --git a/tests/expected/derive-invariant/safety_invariant_fail_mut/expected b/tests/expected/derive-invariant/safety_invariant_fail_mut/expected
new file mode 100644
index 000000000000..0853a68fa79e
--- /dev/null
+++ b/tests/expected/derive-invariant/safety_invariant_fail_mut/expected
@@ -0,0 +1,11 @@
+Check 1: check_invariant_fail_mut.assertion.1\
+         - Status: SUCCESS\
+         - Description: "assertion failed: pos_point.is_safe()"
+
+Check 2: check_invariant_fail_mut.assertion.2\
+         - Status: FAILURE\
+         - Description: "assertion failed: pos_point.is_safe()"
+
+VERIFICATION:- SUCCESSFUL (encountered one or more panics as expected)
+
+Complete - 1 successfully verified harnesses, 0 failures, 1 total.
diff --git a/tests/expected/derive-invariant/safety_invariant_fail_mut/safety_invariant_fail_mut.rs b/tests/expected/derive-invariant/safety_invariant_fail_mut/safety_invariant_fail_mut.rs
new file mode 100644
index 000000000000..dc659ec66dd6
--- /dev/null
+++ b/tests/expected/derive-invariant/safety_invariant_fail_mut/safety_invariant_fail_mut.rs
@@ -0,0 +1,28 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Check that a verification failure is triggered if we check the invariant
+//! after mutating an object to violate it.
+
+extern crate kani;
+use kani::Invariant;
+
+#[derive(kani::Arbitrary)]
+#[derive(kani::Invariant)]
+struct PositivePoint {
+    #[safety_constraint(*x >= 0)]
+    x: i32,
+    #[safety_constraint(*y >= 0)]
+    y: i32,
+}
+
+#[kani::proof]
+#[kani::should_panic]
+fn check_invariant_fail_mut() {
+    let mut pos_point: PositivePoint = kani::any();
+    assert!(pos_point.is_safe());
+    // Set the `x` field to an unsafe value
+    pos_point.x = -1;
+    // The object's invariant isn't preserved anymore so the next check fails
+    assert!(pos_point.is_safe());
+}
diff --git a/tests/expected/function-contract/const_fn_with_effect.rs b/tests/expected/function-contract/const_fn_with_effect.rs
index d57c1f42fe16..070c44482a80 100644
--- a/tests/expected/function-contract/const_fn_with_effect.rs
+++ b/tests/expected/function-contract/const_fn_with_effect.rs
@@ -1,11 +1,13 @@
 // Copyright Kani Contributors
 // SPDX-License-Identifier: Apache-2.0 OR MIT
 // kani-flags: -Zfunction-contracts -Zmem-predicates
+// compile-flags: -Znext-solver
 
 //! Check that Kani contract can be applied to a constant function.
 //! <https://github.com/model-checking/kani/issues/3258>
 
 #![feature(effects)]
+#![allow(incomplete_features)]
 
 #[kani::requires(kani::mem::can_dereference(arg))]
 const unsafe fn dummy<T>(arg: *const T) -> T {
diff --git a/tests/expected/function-contract/modifies_fat_pointer/nondeterministic_size.expected b/tests/expected/function-contract/modifies_fat_pointer/nondeterministic_size.expected
new file mode 100644
index 000000000000..2fab679b5cba
--- /dev/null
+++ b/tests/expected/function-contract/modifies_fat_pointer/nondeterministic_size.expected
@@ -0,0 +1,5 @@
+assertion\
+- Status: SUCCESS\
+- Description: "|_| x.iter().map(|v| *v == 0).fold(true,|a,b|a&b)"\
+
+VERIFICATION:- SUCCESSFUL
diff --git a/tests/expected/function-contract/modifies_fat_pointer/nondeterministic_size.rs b/tests/expected/function-contract/modifies_fat_pointer/nondeterministic_size.rs
new file mode 100644
index 000000000000..faf1d9d44581
--- /dev/null
+++ b/tests/expected/function-contract/modifies_fat_pointer/nondeterministic_size.rs
@@ -0,0 +1,17 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Zfunction-contracts
+
+// Test that modifies a slice of nondeterministic size
+
+#[kani::modifies(x)]
+#[kani::ensures(|_| x.iter().map(|v| *v == 0).fold(true,|a,b|a&b))]
+fn zero(x: &mut [u8]) {
+    x.fill(0)
+}
+
+#[kani::proof_for_contract(zero)]
+fn harness() {
+    let mut x = [0..kani::any()].map(|_| kani::any());
+    zero(&mut x);
+}
diff --git a/tests/expected/function-contract/modifies_fat_pointer/slice_of_array.expected b/tests/expected/function-contract/modifies_fat_pointer/slice_of_array.expected
new file mode 100644
index 000000000000..d0fc296ef4d7
--- /dev/null
+++ b/tests/expected/function-contract/modifies_fat_pointer/slice_of_array.expected
@@ -0,0 +1,5 @@
+assertion\
+- Status: SUCCESS\
+- Description: "|_| x[0..3].iter().map(|v| *v == 0).fold(true,|a,b|a&b)"\
+
+VERIFICATION:- SUCCESSFUL
diff --git a/tests/expected/function-contract/modifies_fat_pointer/slice_of_array.rs b/tests/expected/function-contract/modifies_fat_pointer/slice_of_array.rs
new file mode 100644
index 000000000000..a0f6c10ad694
--- /dev/null
+++ b/tests/expected/function-contract/modifies_fat_pointer/slice_of_array.rs
@@ -0,0 +1,17 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Zfunction-contracts
+
+// Test that modifies a slice containing u32 size data
+
+#[kani::modifies(&x[0..3])]
+#[kani::ensures(|_| x[0..3].iter().map(|v| *v == 0).fold(true,|a,b|a&b))]
+fn zero(x: &mut [u32; 6]) {
+    x[0..3].fill(0)
+}
+
+#[kani::proof_for_contract(zero)]
+fn harness() {
+    let mut x = [kani::any(), kani::any(), kani::any(), kani::any(), kani::any(), kani::any()];
+    zero(&mut x);
+}
diff --git a/tests/expected/function-contract/modifies_fat_pointer/string_rewrite_ignore.rs b/tests/expected/function-contract/modifies_fat_pointer/string_rewrite_ignore.rs
new file mode 100644
index 000000000000..d8780068a0da
--- /dev/null
+++ b/tests/expected/function-contract/modifies_fat_pointer/string_rewrite_ignore.rs
@@ -0,0 +1,19 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Zfunction-contracts
+
+// Test that modifies a string
+
+#[kani::requires(x == "aaa")]
+#[kani::modifies(x)]
+#[kani::ensures(|_| x == "AAA")]
+fn to_upper(x: &mut str) {
+    x.make_ascii_uppercase();
+}
+
+#[kani::proof_for_contract(to_upper)]
+fn harness() {
+    let mut s = String::from("aaa");
+    let x: &mut str = s.as_mut_str();
+    to_upper(x);
+}
diff --git a/tests/expected/function-contract/modifies_fat_pointer/u32slice.expected b/tests/expected/function-contract/modifies_fat_pointer/u32slice.expected
new file mode 100644
index 000000000000..2fab679b5cba
--- /dev/null
+++ b/tests/expected/function-contract/modifies_fat_pointer/u32slice.expected
@@ -0,0 +1,5 @@
+assertion\
+- Status: SUCCESS\
+- Description: "|_| x.iter().map(|v| *v == 0).fold(true,|a,b|a&b)"\
+
+VERIFICATION:- SUCCESSFUL
diff --git a/tests/expected/function-contract/modifies_fat_pointer/u32slice.rs b/tests/expected/function-contract/modifies_fat_pointer/u32slice.rs
new file mode 100644
index 000000000000..ea61de83e969
--- /dev/null
+++ b/tests/expected/function-contract/modifies_fat_pointer/u32slice.rs
@@ -0,0 +1,17 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Zfunction-contracts
+
+// Test that modifies a slice containing u32 size data
+
+#[kani::modifies(x)]
+#[kani::ensures(|_| x.iter().map(|v| *v == 0).fold(true,|a,b|a&b))]
+fn zero(x: &mut [u32]) {
+    x.fill(0)
+}
+
+#[kani::proof_for_contract(zero)]
+fn harness() {
+    let mut x = [kani::any(), kani::any(), kani::any()];
+    zero(&mut x);
+}
diff --git a/tests/expected/function-contract/modifies_fat_pointer/u8slice.expected b/tests/expected/function-contract/modifies_fat_pointer/u8slice.expected
new file mode 100644
index 000000000000..2fab679b5cba
--- /dev/null
+++ b/tests/expected/function-contract/modifies_fat_pointer/u8slice.expected
@@ -0,0 +1,5 @@
+assertion\
+- Status: SUCCESS\
+- Description: "|_| x.iter().map(|v| *v == 0).fold(true,|a,b|a&b)"\
+
+VERIFICATION:- SUCCESSFUL
diff --git a/tests/expected/function-contract/modifies_fat_pointer/u8slice.rs b/tests/expected/function-contract/modifies_fat_pointer/u8slice.rs
new file mode 100644
index 000000000000..07e213db0adc
--- /dev/null
+++ b/tests/expected/function-contract/modifies_fat_pointer/u8slice.rs
@@ -0,0 +1,17 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Zfunction-contracts
+
+// Test that modifies a slice containing bytesize data
+
+#[kani::modifies(x)]
+#[kani::ensures(|_| x.iter().map(|v| *v == 0).fold(true,|a,b|a&b))]
+fn zero(x: &mut [u8]) {
+    x.fill(0)
+}
+
+#[kani::proof_for_contract(zero)]
+fn harness() {
+    let mut x = [kani::any(), kani::any(), kani::any()];
+    zero(&mut x);
+}
diff --git a/tests/expected/function-contract/simple_ensures_pass_no_annotation.expected b/tests/expected/function-contract/simple_ensures_pass_no_annotation.expected
new file mode 100644
index 000000000000..0779b6dc88f8
--- /dev/null
+++ b/tests/expected/function-contract/simple_ensures_pass_no_annotation.expected
@@ -0,0 +1,6 @@
+assertion\
+- Status: SUCCESS\
+- Description: "|result| (*result == x) | (*result == y)"\
+in function max
+
+VERIFICATION:- SUCCESSFUL
diff --git a/tests/expected/function-contract/simple_ensures_pass_no_annotation.rs b/tests/expected/function-contract/simple_ensures_pass_no_annotation.rs
new file mode 100644
index 000000000000..a3bf30e1c0f7
--- /dev/null
+++ b/tests/expected/function-contract/simple_ensures_pass_no_annotation.rs
@@ -0,0 +1,14 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Zfunction-contracts
+
+#[kani::ensures(|result| (*result == x) | (*result == y))]
+fn max(x: u32, y: u32) -> u32 {
+    if x > y { x } else { y }
+}
+
+#[kani::proof_for_contract(max)]
+fn max_harness() {
+    let _ = Box::new(9_usize);
+    max(7, 6);
+}
diff --git a/tests/expected/function-stubbing-no-harness/main.rs b/tests/expected/function-stubbing-no-harness/main.rs
index 1819c8dce862..d69192ae2180 100644
--- a/tests/expected/function-stubbing-no-harness/main.rs
+++ b/tests/expected/function-stubbing-no-harness/main.rs
@@ -1,7 +1,7 @@
 // Copyright Kani Contributors
 // SPDX-License-Identifier: Apache-2.0 OR MIT
 //
-// kani-flags: --harness foo --enable-unstable --enable-stubbing
+// kani-flags: --harness foo -Z stubbing
 //
 //! This tests whether we detect missing harnesses during stubbing.
 
diff --git a/tests/expected/shadow/slices/slice_of_array/expected b/tests/expected/shadow/slices/slice_of_array/expected
new file mode 100644
index 000000000000..34c886c358cb
--- /dev/null
+++ b/tests/expected/shadow/slices/slice_of_array/expected
@@ -0,0 +1 @@
+VERIFICATION:- SUCCESSFUL
diff --git a/tests/expected/shadow/slices/slice_of_array/test.rs b/tests/expected/shadow/slices/slice_of_array/test.rs
new file mode 100644
index 000000000000..b5ac3abae126
--- /dev/null
+++ b/tests/expected/shadow/slices/slice_of_array/test.rs
@@ -0,0 +1,34 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Zghost-state
+
+// This test demonstrates a possible usage of the shadow memory API to check that
+// every element of an arbitrary slice of an array is initialized.
+// Since the instrumentation is done manually in the harness only but not inside
+// the library functions, the test only verifies that the slices point to memory
+// that is within the original array.
+
+const N: usize = 16;
+
+static mut SM: kani::shadow::ShadowMem<bool> = kani::shadow::ShadowMem::new(false);
+
+#[kani::proof]
+#[kani::unwind(31)]
+fn check_slice_init() {
+    let arr: [char; N] = kani::any();
+    // tag every element of the array as initialized
+    for i in &arr {
+        unsafe {
+            SM.set(i as *const char, true);
+        }
+    }
+    // create an arbitrary slice of the array
+    let end: usize = kani::any_where(|x| *x <= N);
+    let begin: usize = kani::any_where(|x| *x < end);
+    let slice = &arr[begin..end];
+
+    // verify that all elements of the slice are initialized
+    for i in slice {
+        assert!(unsafe { SM.get(i as *const char) });
+    }
+}
diff --git a/tests/expected/shadow/slices/slice_reverse/expected b/tests/expected/shadow/slices/slice_reverse/expected
new file mode 100644
index 000000000000..34c886c358cb
--- /dev/null
+++ b/tests/expected/shadow/slices/slice_reverse/expected
@@ -0,0 +1 @@
+VERIFICATION:- SUCCESSFUL
diff --git a/tests/expected/shadow/slices/slice_reverse/test.rs b/tests/expected/shadow/slices/slice_reverse/test.rs
new file mode 100644
index 000000000000..4810958e2fe1
--- /dev/null
+++ b/tests/expected/shadow/slices/slice_reverse/test.rs
@@ -0,0 +1,28 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Zghost-state
+
+// This test demonstrates a possible usage of the shadow memory API to check that
+// every element of a reversed array is initialized.
+// Since the instrumentation is done manually in the harness only but not inside
+// the `reverse` function, the test only verifies that the resulting array
+// occupies the same memory as the original one.
+
+const N: usize = 32;
+
+static mut SM: kani::shadow::ShadowMem<bool> = kani::shadow::ShadowMem::new(false);
+
+#[kani::proof]
+fn check_reverse() {
+    let mut a: [u16; N] = kani::any();
+    for i in &a {
+        unsafe { SM.set(i as *const u16, true) };
+    }
+    a.reverse();
+
+    for i in &a {
+        unsafe {
+            assert!(SM.get(i as *const u16));
+        }
+    }
+}
diff --git a/tests/expected/shadow/slices/slice_split/expected b/tests/expected/shadow/slices/slice_split/expected
new file mode 100644
index 000000000000..34c886c358cb
--- /dev/null
+++ b/tests/expected/shadow/slices/slice_split/expected
@@ -0,0 +1 @@
+VERIFICATION:- SUCCESSFUL
diff --git a/tests/expected/shadow/slices/slice_split/test.rs b/tests/expected/shadow/slices/slice_split/test.rs
new file mode 100644
index 000000000000..273d717572d1
--- /dev/null
+++ b/tests/expected/shadow/slices/slice_split/test.rs
@@ -0,0 +1,35 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Zghost-state
+
+// This test demonstrates a possible usage of the shadow memory API to check that
+// every element of an array split into two slices is initialized.
+// Since the instrumentation is done manually in the harness only but not inside
+// the `split_at_checked` function, the test only verifies that the resulting
+// slices occupy the same memory as the original array.
+
+const N: usize = 16;
+
+static mut SM: kani::shadow::ShadowMem<bool> = kani::shadow::ShadowMem::new(false);
+
+#[kani::proof]
+#[kani::unwind(17)]
+fn check_reverse() {
+    let a: [bool; N] = kani::any();
+    for i in &a {
+        unsafe { SM.set(i as *const bool, true) };
+    }
+    let index: usize = kani::any_where(|x| *x <= N);
+    let (s1, s2) = a.split_at_checked(index).unwrap();
+
+    for i in s1 {
+        unsafe {
+            assert!(SM.get(i as *const bool));
+        }
+    }
+    for i in s2 {
+        unsafe {
+            assert!(SM.get(i as *const bool));
+        }
+    }
+}
diff --git a/tests/expected/stubbing-ambiguous-path/main.rs b/tests/expected/stubbing-ambiguous-path/main.rs
index 7a406d51d227..9ab25b501a44 100644
--- a/tests/expected/stubbing-ambiguous-path/main.rs
+++ b/tests/expected/stubbing-ambiguous-path/main.rs
@@ -1,7 +1,7 @@
 // Copyright Kani Contributors
 // SPDX-License-Identifier: Apache-2.0 OR MIT
 //
-// kani-flags: --harness main --enable-unstable --enable-stubbing
+// kani-flags: --harness main -Z stubbing
 //
 //! This tests that we raise an error if a path in a `kani::stub` attribute can
 //! resolve to multiple functions.
diff --git a/tests/expected/uninit/access-padding-uninit/access-padding-uninit.rs b/tests/expected/uninit/access-padding-uninit/access-padding-uninit.rs
new file mode 100644
index 000000000000..8e65b95aefa2
--- /dev/null
+++ b/tests/expected/uninit/access-padding-uninit/access-padding-uninit.rs
@@ -0,0 +1,16 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::ptr::addr_of;
+
+#[repr(C)]
+struct S(u32, u8);
+
+/// Checks that Kani catches an attempt to access padding of a struct using raw pointers.
+#[kani::proof]
+fn check_uninit_padding() {
+    let s = S(0, 0);
+    let ptr: *const u8 = addr_of!(s) as *const u8;
+    let padding = unsafe { *(ptr.add(5)) }; // ~ERROR: padding bytes are uninitialized, so reading them is UB.
+}
diff --git a/tests/expected/uninit/access-padding-uninit/expected b/tests/expected/uninit/access-padding-uninit/expected
new file mode 100644
index 000000000000..da8d15b2dbb9
--- /dev/null
+++ b/tests/expected/uninit/access-padding-uninit/expected
@@ -0,0 +1,5 @@
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*const u8`
+
+VERIFICATION:- FAILED
+
+Complete - 0 successfully verified harnesses, 1 failures, 1 total.
\ No newline at end of file
diff --git a/tests/expected/uninit/access-padding-via-cast/access-padding-via-cast.rs b/tests/expected/uninit/access-padding-via-cast/access-padding-via-cast.rs
new file mode 100644
index 000000000000..1604625fc54c
--- /dev/null
+++ b/tests/expected/uninit/access-padding-via-cast/access-padding-via-cast.rs
@@ -0,0 +1,20 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::ptr;
+#[repr(C)]
+struct S(u8, u16);
+
+/// Checks that Kani catches an attempt to access padding of a struct using casting to different types.
+#[kani::proof]
+fn check_uninit_padding_after_cast() {
+    unsafe {
+        let mut s = S(0, 0);
+        let sptr = ptr::addr_of_mut!(s);
+        let sptr2 = sptr as *mut [u8; 4];
+        *sptr2 = [0; 4];
+        *sptr = S(0, 0); // should reset the padding
+        let val = *sptr2; // ~ERROR: encountered uninitialized memory
+    }
+}
diff --git a/tests/expected/uninit/access-padding-via-cast/expected b/tests/expected/uninit/access-padding-via-cast/expected
new file mode 100644
index 000000000000..e02883b26cdf
--- /dev/null
+++ b/tests/expected/uninit/access-padding-via-cast/expected
@@ -0,0 +1,5 @@
+Failed Checks: Kani does not support reasoning about memory initialization in presence of mutable raw pointer casts that could cause delayed UB.
+
+VERIFICATION:- FAILED
+
+Complete - 0 successfully verified harnesses, 1 failures, 1 total.
\ No newline at end of file
diff --git a/tests/expected/uninit/alloc-to-slice/alloc-to-slice.rs b/tests/expected/uninit/alloc-to-slice/alloc-to-slice.rs
new file mode 100644
index 000000000000..318f234c31be
--- /dev/null
+++ b/tests/expected/uninit/alloc-to-slice/alloc-to-slice.rs
@@ -0,0 +1,20 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::alloc::{alloc, Layout};
+use std::slice::from_raw_parts;
+
+/// Checks that Kani catches an attempt to form a slice from uninitialized memory.
+#[kani::proof]
+fn check_uninit_slice() {
+    let layout = Layout::from_size_align(16, 8).unwrap();
+    unsafe {
+        let ptr = alloc(layout);
+        *ptr = 0x41;
+        *ptr.add(1) = 0x42;
+        *ptr.add(2) = 0x43;
+        *ptr.add(3) = 0x44;
+        let uninit_slice = from_raw_parts(ptr, 16); // ~ERROR: forming a slice from unitialized memory is UB.
+    }
+}
diff --git a/tests/expected/uninit/alloc-to-slice/expected b/tests/expected/uninit/alloc-to-slice/expected
new file mode 100644
index 000000000000..f8347a591edf
--- /dev/null
+++ b/tests/expected/uninit/alloc-to-slice/expected
@@ -0,0 +1,5 @@
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*const [u8]`
+
+VERIFICATION:- FAILED
+
+Complete - 0 successfully verified harnesses, 1 failures, 1 total.
\ No newline at end of file
diff --git a/tests/expected/uninit/atomic/atomic.rs b/tests/expected/uninit/atomic/atomic.rs
new file mode 100644
index 000000000000..63c85af41a3f
--- /dev/null
+++ b/tests/expected/uninit/atomic/atomic.rs
@@ -0,0 +1,31 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+#![feature(core_intrinsics)]
+
+use std::alloc::{alloc, Layout};
+use std::sync::atomic::{AtomicU8, Ordering};
+
+// Checks if memory initialization checks correctly fail when uninitialized memory is passed to
+// atomic intrinsics.
+#[kani::proof]
+fn local_atomic_uninit() {
+    // Get a pointer to an uninitialized value
+    let layout = Layout::from_size_align(16, 8).unwrap();
+    let ptr: *mut u8 = unsafe { alloc(layout) };
+    // Try accessing `ptr` via atomic intrinsics, should be UB in each case.
+    unsafe {
+        match kani::any() {
+            0 => {
+                std::intrinsics::atomic_store_relaxed(ptr, 1);
+            }
+            1 => {
+                std::intrinsics::atomic_load_relaxed(ptr as *const u8);
+            }
+            _ => {
+                std::intrinsics::atomic_cxchg_relaxed_relaxed(ptr, 1, 1);
+            }
+        };
+    }
+}
diff --git a/tests/expected/uninit/atomic/expected b/tests/expected/uninit/atomic/expected
new file mode 100644
index 000000000000..c7d9593f22a7
--- /dev/null
+++ b/tests/expected/uninit/atomic/expected
@@ -0,0 +1,13 @@
+SUMMARY:
+
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*mut u8`
+
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*const u8`
+
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*mut u8`
+
+VERIFICATION:- FAILED
+
+Summary:\
+Verification failed for - local_atomic_uninit\
+Complete - 0 successfully verified harnesses, 1 failures, 1 total.
diff --git a/tests/expected/uninit/delayed-ub-transmute/delayed-ub-transmute.rs b/tests/expected/uninit/delayed-ub-transmute/delayed-ub-transmute.rs
new file mode 100644
index 000000000000..df769e39a8b2
--- /dev/null
+++ b/tests/expected/uninit/delayed-ub-transmute/delayed-ub-transmute.rs
@@ -0,0 +1,14 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+/// Checks that Kani rejects mutable pointer casts between types of different padding.
+#[kani::proof]
+fn invalid_value() {
+    unsafe {
+        let mut value: u128 = 0;
+        let ptr: *mut (u8, u32, u64) = std::mem::transmute(&mut value as *mut _);
+        *ptr = (4, 4, 4); // This assignment itself does not cause UB...
+        let c: u128 = value; // ...but this reads a padding value!
+    }
+}
diff --git a/tests/expected/uninit/delayed-ub-transmute/expected b/tests/expected/uninit/delayed-ub-transmute/expected
new file mode 100644
index 000000000000..e02883b26cdf
--- /dev/null
+++ b/tests/expected/uninit/delayed-ub-transmute/expected
@@ -0,0 +1,5 @@
+Failed Checks: Kani does not support reasoning about memory initialization in presence of mutable raw pointer casts that could cause delayed UB.
+
+VERIFICATION:- FAILED
+
+Complete - 0 successfully verified harnesses, 1 failures, 1 total.
\ No newline at end of file
diff --git a/tests/expected/uninit/delayed-ub/delayed-ub.rs b/tests/expected/uninit/delayed-ub/delayed-ub.rs
new file mode 100644
index 000000000000..bfed0a1f39a1
--- /dev/null
+++ b/tests/expected/uninit/delayed-ub/delayed-ub.rs
@@ -0,0 +1,14 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z ghost-state -Z uninit-checks
+
+/// Checks that Kani rejects mutable pointer casts between types of different padding.
+#[kani::proof]
+fn invalid_value() {
+    unsafe {
+        let mut value: u128 = 0;
+        let ptr = &mut value as *mut _ as *mut (u8, u32, u64);
+        *ptr = (4, 4, 4); // This assignment itself does not cause UB...
+        let c: u128 = value; // ...but this reads a padding value!
+    }
+}
diff --git a/tests/expected/uninit/delayed-ub/expected b/tests/expected/uninit/delayed-ub/expected
new file mode 100644
index 000000000000..e02883b26cdf
--- /dev/null
+++ b/tests/expected/uninit/delayed-ub/expected
@@ -0,0 +1,5 @@
+Failed Checks: Kani does not support reasoning about memory initialization in presence of mutable raw pointer casts that could cause delayed UB.
+
+VERIFICATION:- FAILED
+
+Complete - 0 successfully verified harnesses, 1 failures, 1 total.
\ No newline at end of file
diff --git a/tests/expected/uninit/intrinsics/expected b/tests/expected/uninit/intrinsics/expected
new file mode 100644
index 000000000000..ffa98b6f1140
--- /dev/null
+++ b/tests/expected/uninit/intrinsics/expected
@@ -0,0 +1,70 @@
+Checking harness check_typed_swap_safe...
+
+Failed Checks: Kani does not support reasoning about memory initialization in presence of mutable raw pointer casts that could cause delayed UB.
+
+VERIFICATION:- FAILED
+
+Checking harness check_typed_swap...
+
+Failed Checks: Kani does not support reasoning about memory initialization in presence of mutable raw pointer casts that could cause delayed UB.
+
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*mut u8`
+
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*mut u8`
+
+VERIFICATION:- FAILED
+
+Checking harness check_volatile_store_and_load_safe...
+
+VERIFICATION:- SUCCESSFUL
+
+Checking harness check_volatile_load...
+
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*const u8`
+
+VERIFICATION:- FAILED
+
+Checking harness check_write_bytes_safe...
+
+VERIFICATION:- SUCCESSFUL
+
+Checking harness check_compare_bytes_safe...
+
+VERIFICATION:- SUCCESSFUL
+
+Checking harness check_compare_bytes...
+
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*const u8`
+
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*const u8`
+
+VERIFICATION:- FAILED
+
+Checking harness check_copy_safe...
+
+VERIFICATION:- SUCCESSFUL
+
+Checking harness check_copy...
+
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*const u8`
+
+VERIFICATION:- FAILED
+
+Checking harness check_copy_nonoverlapping_safe...
+
+VERIFICATION:- SUCCESSFUL
+
+Checking harness check_copy_nonoverlapping...
+
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*const u8`
+
+VERIFICATION:- FAILED
+
+Summary:
+Verification failed for - check_typed_swap_safe
+Verification failed for - check_typed_swap
+Verification failed for - check_volatile_load
+Verification failed for - check_compare_bytes
+Verification failed for - check_copy
+Verification failed for - check_copy_nonoverlapping
+Complete - 5 successfully verified harnesses, 6 failures, 11 total.
diff --git a/tests/expected/uninit/intrinsics/intrinsics.rs b/tests/expected/uninit/intrinsics/intrinsics.rs
new file mode 100644
index 000000000000..aa8a89b7b959
--- /dev/null
+++ b/tests/expected/uninit/intrinsics/intrinsics.rs
@@ -0,0 +1,127 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+//! Checks that Kani supports memory initialization checks via intrinsics.
+
+#![feature(core_intrinsics)]
+
+use std::alloc::{alloc, alloc_zeroed, Layout};
+use std::intrinsics::*;
+
+#[kani::proof]
+fn check_copy_nonoverlapping() {
+    unsafe {
+        let layout = Layout::from_size_align(16, 8).unwrap();
+        let src: *mut u8 = alloc(layout);
+        let dst: *mut u8 = alloc(layout);
+        copy_nonoverlapping(src as *const u8, dst, 2); // ~ERROR: Accessing `src` here, which is uninitialized.
+    }
+}
+
+#[kani::proof]
+fn check_copy_nonoverlapping_safe() {
+    unsafe {
+        let layout = Layout::from_size_align(16, 8).unwrap();
+        let src: *mut u8 = alloc_zeroed(layout);
+        let dst: *mut u8 = alloc(layout);
+        // `src` is initialized here, `dst` is uninitialized, but it is fine since we are writing into it.
+        copy_nonoverlapping(src as *const u8, dst, 2);
+    }
+}
+
+#[kani::proof]
+fn check_copy() {
+    unsafe {
+        let layout = Layout::from_size_align(16, 8).unwrap();
+        let src: *mut u8 = alloc(layout);
+        let dst: *mut u8 = alloc(layout);
+        copy(src as *const u8, dst, 2); // ~ERROR: Accessing `src` here, which is uninitialized.
+    }
+}
+
+#[kani::proof]
+fn check_copy_safe() {
+    unsafe {
+        let layout = Layout::from_size_align(16, 8).unwrap();
+        let src: *mut u8 = alloc_zeroed(layout);
+        let dst: *mut u8 = alloc(layout);
+        // `src` is initialized here, `dst` is uninitialized, but it is fine since we are writing into it.
+        copy(src as *const u8, dst, 2);
+    }
+}
+
+#[kani::proof]
+fn check_compare_bytes() {
+    unsafe {
+        let layout = Layout::from_size_align(16, 8).unwrap();
+        let left: *mut u8 = alloc(layout);
+        let right: *mut u8 = alloc(layout);
+        // ~ERROR: Accessing `left` and `right` here, both of which are uninitialized.
+        compare_bytes(left as *const u8, right as *const u8, 2);
+    }
+}
+
+#[kani::proof]
+fn check_compare_bytes_safe() {
+    unsafe {
+        let layout = Layout::from_size_align(16, 8).unwrap();
+        let left: *mut u8 = alloc_zeroed(layout);
+        let right: *mut u8 = alloc_zeroed(layout);
+        // Both `left` and `right` are initialized here.
+        compare_bytes(left as *const u8, right as *const u8, 2);
+    }
+}
+
+#[kani::proof]
+fn check_write_bytes_safe() {
+    unsafe {
+        let layout = Layout::from_size_align(16, 8).unwrap();
+        let left: *mut u8 = alloc(layout);
+        let right: *mut u8 = alloc(layout);
+        write_bytes(left, 0, 2);
+        write_bytes(right, 0, 2);
+        // Both `left` and `right` are initialized here.
+        compare_bytes(left as *const u8, right as *const u8, 2);
+    }
+}
+
+#[kani::proof]
+fn check_volatile_load() {
+    unsafe {
+        let layout = Layout::from_size_align(16, 8).unwrap();
+        let src: *mut u8 = alloc(layout);
+        volatile_load(src as *const u8); // ~ERROR: Accessing `src` here, which is uninitialized.
+    }
+}
+
+#[kani::proof]
+fn check_volatile_store_and_load_safe() {
+    unsafe {
+        let layout = Layout::from_size_align(16, 8).unwrap();
+        let src: *mut u8 = alloc(layout);
+        volatile_store(src, 0);
+        volatile_load(src as *const u8); // `src` is initialized here.
+    }
+}
+
+#[kani::proof]
+fn check_typed_swap() {
+    unsafe {
+        let layout = Layout::from_size_align(16, 8).unwrap();
+        let left: *mut u8 = alloc(layout);
+        let right: *mut u8 = alloc(layout);
+        // ~ERROR: Accessing `left` and `right` here, both of which are uninitialized.
+        typed_swap(left, right);
+    }
+}
+
+#[kani::proof]
+fn check_typed_swap_safe() {
+    unsafe {
+        let layout = Layout::from_size_align(16, 8).unwrap();
+        let left: *mut u8 = alloc_zeroed(layout);
+        let right: *mut u8 = alloc_zeroed(layout);
+        // Both `left` and `right` are initialized here.
+        typed_swap(left, right);
+    }
+}
diff --git a/tests/expected/uninit/transmute-padding/expected b/tests/expected/uninit/transmute-padding/expected
new file mode 100644
index 000000000000..980a01748fc7
--- /dev/null
+++ b/tests/expected/uninit/transmute-padding/expected
@@ -0,0 +1,5 @@
+Failed Checks: Transmuting between types of incompatible layouts.
+
+VERIFICATION:- FAILED
+
+Complete - 0 successfully verified harnesses, 1 failures, 1 total.
\ No newline at end of file
diff --git a/tests/expected/uninit/transmute-padding/transmute_padding.rs b/tests/expected/uninit/transmute-padding/transmute_padding.rs
new file mode 100644
index 000000000000..b74346c98160
--- /dev/null
+++ b/tests/expected/uninit/transmute-padding/transmute_padding.rs
@@ -0,0 +1,19 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+// 5 bytes of data + 3 bytes of padding.
+#[repr(C)]
+#[derive(kani::Arbitrary)]
+struct S(u32, u8);
+
+/// Checks that Kani catches an attempt to access padding of a struct using transmute.
+#[kani::proof]
+fn check_uninit_padding() {
+    let s = kani::any();
+    access_padding(s);
+}
+
+fn access_padding(s: S) {
+    let _padding: u64 = unsafe { std::mem::transmute(s) }; // ~ERROR: padding bytes are uninitialized, so reading them is UB.
+}
diff --git a/tests/expected/uninit/vec-read-bad-len/expected b/tests/expected/uninit/vec-read-bad-len/expected
new file mode 100644
index 000000000000..f8347a591edf
--- /dev/null
+++ b/tests/expected/uninit/vec-read-bad-len/expected
@@ -0,0 +1,5 @@
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*const [u8]`
+
+VERIFICATION:- FAILED
+
+Complete - 0 successfully verified harnesses, 1 failures, 1 total.
\ No newline at end of file
diff --git a/tests/expected/uninit/vec-read-bad-len/vec-read-bad-len.rs b/tests/expected/uninit/vec-read-bad-len/vec-read-bad-len.rs
new file mode 100644
index 000000000000..f5cae82c5350
--- /dev/null
+++ b/tests/expected/uninit/vec-read-bad-len/vec-read-bad-len.rs
@@ -0,0 +1,15 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::ops::Index;
+
+/// Checks that Kani catches an attempt to read uninitialized memory from a vector with bad length.
+#[kani::proof]
+fn check_vec_read_bad_len() {
+    let mut v: Vec<u8> = Vec::with_capacity(10);
+    unsafe {
+        v.set_len(5); // even though length is now 5, vector is still uninitialized
+    }
+    let uninit = v.index(0); // ~ERROR: reading from unitialized memory is UB.
+}
diff --git a/tests/expected/uninit/vec-read-semi-init/expected b/tests/expected/uninit/vec-read-semi-init/expected
new file mode 100644
index 000000000000..da8d15b2dbb9
--- /dev/null
+++ b/tests/expected/uninit/vec-read-semi-init/expected
@@ -0,0 +1,5 @@
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*const u8`
+
+VERIFICATION:- FAILED
+
+Complete - 0 successfully verified harnesses, 1 failures, 1 total.
\ No newline at end of file
diff --git a/tests/expected/uninit/vec-read-semi-init/vec-read-semi-init.rs b/tests/expected/uninit/vec-read-semi-init/vec-read-semi-init.rs
new file mode 100644
index 000000000000..2e007cabaced
--- /dev/null
+++ b/tests/expected/uninit/vec-read-semi-init/vec-read-semi-init.rs
@@ -0,0 +1,11 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+/// Checks that Kani catches an attempt to read uninitialized memory from a semi-initialized vector.
+#[kani::proof]
+fn check_vec_read_semi_init() {
+    let mut v: Vec<u8> = Vec::with_capacity(10);
+    unsafe { *v.as_mut_ptr().add(4) = 0x42 };
+    let uninit = unsafe { *v.as_ptr().add(5) }; // ~ERROR: reading from unitialized memory is UB.
+}
diff --git a/tests/expected/uninit/vec-read-uninit/expected b/tests/expected/uninit/vec-read-uninit/expected
new file mode 100644
index 000000000000..da8d15b2dbb9
--- /dev/null
+++ b/tests/expected/uninit/vec-read-uninit/expected
@@ -0,0 +1,5 @@
+Failed Checks: Undefined Behavior: Reading from an uninitialized pointer of type `*const u8`
+
+VERIFICATION:- FAILED
+
+Complete - 0 successfully verified harnesses, 1 failures, 1 total.
\ No newline at end of file
diff --git a/tests/expected/uninit/vec-read-uninit/vec-read-uninit.rs b/tests/expected/uninit/vec-read-uninit/vec-read-uninit.rs
new file mode 100644
index 000000000000..e6daf80cd5e3
--- /dev/null
+++ b/tests/expected/uninit/vec-read-uninit/vec-read-uninit.rs
@@ -0,0 +1,10 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+/// Checks that Kani catches an attempt to read uninitialized memory from an uninitialized vector.
+#[kani::proof]
+fn check_vec_read_uninit() {
+    let v: Vec<u8> = Vec::with_capacity(10);
+    let uninit = unsafe { *v.as_ptr().add(5) }; // ~ERROR: reading from unitialized memory is UB.
+}
diff --git a/tests/kani/FloatingPoint/main.rs b/tests/kani/FloatingPoint/main.rs
index c04bd9b305f8..f8ebccdac02a 100644
--- a/tests/kani/FloatingPoint/main.rs
+++ b/tests/kani/FloatingPoint/main.rs
@@ -1,5 +1,9 @@
 // Copyright Kani Contributors
 // SPDX-License-Identifier: Apache-2.0 OR MIT
+
+#![feature(f16)]
+#![feature(f128)]
+
 macro_rules! test_floats {
     ($ty:ty) => {
         let a: $ty = kani::any();
@@ -26,6 +30,8 @@ fn main() {
     assert!(1.1 == 1.1 * 1.0);
     assert!(1.1 != 1.11 / 1.0);
 
+    test_floats!(f16);
     test_floats!(f32);
     test_floats!(f64);
+    test_floats!(f128);
 }
diff --git a/tests/kani/Invariant/invariant_impls.rs b/tests/kani/Invariant/invariant_impls.rs
index 4f00f4134956..146c9731370d 100644
--- a/tests/kani/Invariant/invariant_impls.rs
+++ b/tests/kani/Invariant/invariant_impls.rs
@@ -3,6 +3,10 @@
 
 //! Check the `Invariant` implementations that we include in the Kani library
 //! with respect to the underlying type invariants.
+
+#![feature(f16)]
+#![feature(f128)]
+
 extern crate kani;
 use kani::Invariant;
 
@@ -29,6 +33,9 @@ fn check_safe_impls() {
     check_safe_type!(i128);
     check_safe_type!(isize);
 
+    check_safe_type!(f16);
+    check_safe_type!(f128);
+
     check_safe_type!(f32);
     check_safe_type!(f64);
 
diff --git a/tests/kani/Uninit/access-padding-enum-diverging-variants.rs b/tests/kani/Uninit/access-padding-enum-diverging-variants.rs
new file mode 100644
index 000000000000..fae491c40622
--- /dev/null
+++ b/tests/kani/Uninit/access-padding-enum-diverging-variants.rs
@@ -0,0 +1,34 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::ptr;
+use std::ptr::addr_of;
+
+/// The layout of this enum is variable, so Kani cannot check memory initialization statically.
+#[repr(C)]
+enum E1 {
+    A(u16, u8),
+    B(u16),
+}
+
+/// The layout of this enum is variable, but both of the arms have the same padding, so Kani should
+/// support that.
+#[repr(C)]
+enum E2 {
+    A(u16),
+    B(u8, u8),
+}
+
+#[kani::proof]
+#[kani::should_panic]
+fn access_padding_unsupported() {
+    let s = E1::A(0, 0);
+    let ptr: *const u8 = addr_of!(s) as *const u8;
+}
+
+#[kani::proof]
+fn access_padding_supported() {
+    let s = E2::A(0);
+    let ptr: *const u8 = addr_of!(s) as *const u8;
+}
diff --git a/tests/kani/Uninit/access-padding-enum-multiple-variants.rs b/tests/kani/Uninit/access-padding-enum-multiple-variants.rs
new file mode 100644
index 000000000000..dd6942252cb2
--- /dev/null
+++ b/tests/kani/Uninit/access-padding-enum-multiple-variants.rs
@@ -0,0 +1,49 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::ptr;
+use std::ptr::addr_of;
+
+/// The layout of this enum is the following (D = data, P = padding):
+///  0  1  2  3  4  5  6  7
+/// [D, D, D, D, D, D, D, P]
+///  ----------  -------
+///   \_ tag (i32)  \_ A|B(u16, u8)
+#[repr(C)]
+enum E {
+    A(u16, u8),
+    B(u16, u8),
+}
+
+#[kani::proof]
+fn access_padding_init_a() {
+    let s = E::A(0, 0);
+    let ptr: *const u8 = addr_of!(s) as *const u8;
+    let at_0 = unsafe { *(ptr.add(0)) };
+    let at_4 = unsafe { *(ptr.add(4)) };
+}
+
+#[kani::proof]
+fn access_padding_init_b() {
+    let s = E::A(0, 0);
+    let ptr: *const u8 = addr_of!(s) as *const u8;
+    let at_0 = unsafe { *(ptr.add(0)) };
+    let at_4 = unsafe { *(ptr.add(4)) };
+}
+
+#[kani::proof]
+#[kani::should_panic]
+fn access_padding_uninit_a() {
+    let s = E::A(0, 0);
+    let ptr: *const u8 = addr_of!(s) as *const u8;
+    let at_7 = unsafe { *(ptr.add(7)) };
+}
+
+#[kani::proof]
+#[kani::should_panic]
+fn access_padding_uninit_b() {
+    let s = E::A(0, 0);
+    let ptr: *const u8 = addr_of!(s) as *const u8;
+    let at_7 = unsafe { *(ptr.add(7)) };
+}
diff --git a/tests/kani/Uninit/access-padding-enum-single-field.rs b/tests/kani/Uninit/access-padding-enum-single-field.rs
new file mode 100644
index 000000000000..63f7f6043905
--- /dev/null
+++ b/tests/kani/Uninit/access-padding-enum-single-field.rs
@@ -0,0 +1,34 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::ptr;
+use std::ptr::addr_of;
+
+/// The layout of this enum is the following (D = data, P = padding):
+///  0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
+/// [D, D, D, D, P, P, P, P, D, D, D, D, D, D, D, D]
+///  ----------              ----------------------
+///      \_ tag (i32)                   \_ A(u64)
+#[repr(C)]
+enum E {
+    A(u64),
+}
+
+#[kani::proof]
+fn access_padding_init() {
+    let s = E::A(0);
+    let ptr: *const u8 = addr_of!(s) as *const u8;
+    let at_0 = unsafe { *(ptr.add(0)) };
+    let at_3 = unsafe { *(ptr.add(3)) };
+    let at_9 = unsafe { *(ptr.add(9)) };
+}
+
+#[kani::proof]
+#[kani::should_panic]
+fn access_padding_uninit() {
+    let s = E::A(0);
+    let ptr: *const u8 = addr_of!(s) as *const u8;
+    let at_4 = unsafe { *(ptr.add(4)) };
+    let at_7 = unsafe { *(ptr.add(7)) };
+}
diff --git a/tests/kani/Uninit/access-padding-enum-single-variant.rs b/tests/kani/Uninit/access-padding-enum-single-variant.rs
new file mode 100644
index 000000000000..bb87d36d26c8
--- /dev/null
+++ b/tests/kani/Uninit/access-padding-enum-single-variant.rs
@@ -0,0 +1,32 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::ptr;
+use std::ptr::addr_of;
+
+/// The layout of this enum is the following (D = data, P = padding):
+///  0  1  2  3  4  5  6  7
+/// [D, D, D, D, D, D, D, P]
+///  ----------  -------
+///   \_ tag (i32)  \_ A(u16, u8)
+#[repr(C)]
+enum E {
+    A(u16, u8),
+}
+
+#[kani::proof]
+fn access_padding_init() {
+    let s = E::A(0, 0);
+    let ptr: *const u8 = addr_of!(s) as *const u8;
+    let at_0 = unsafe { *(ptr.add(0)) };
+    let at_4 = unsafe { *(ptr.add(4)) };
+}
+
+#[kani::proof]
+#[kani::should_panic]
+fn access_padding_uninit() {
+    let s = E::A(0, 0);
+    let ptr: *const u8 = addr_of!(s) as *const u8;
+    let at_7 = unsafe { *(ptr.add(7)) };
+}
diff --git a/tests/kani/Uninit/access-padding-init.rs b/tests/kani/Uninit/access-padding-init.rs
new file mode 100644
index 000000000000..7523622a6106
--- /dev/null
+++ b/tests/kani/Uninit/access-padding-init.rs
@@ -0,0 +1,15 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::ptr::addr_of;
+
+#[repr(C)]
+struct S(u32, u8);
+
+#[kani::proof]
+fn access_padding_init() {
+    let s = S(0, 0);
+    let ptr: *const u8 = addr_of!(s) as *const u8;
+    let data = unsafe { *(ptr.add(3)) }; // Accessing data bytes is valid.
+}
diff --git a/tests/kani/Uninit/alloc-to-slice.rs b/tests/kani/Uninit/alloc-to-slice.rs
new file mode 100644
index 000000000000..863d3b40b390
--- /dev/null
+++ b/tests/kani/Uninit/alloc-to-slice.rs
@@ -0,0 +1,19 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::alloc::{alloc, Layout};
+
+#[kani::proof]
+fn alloc_to_slice() {
+    let layout = Layout::from_size_align(32, 8).unwrap();
+    unsafe {
+        let ptr = alloc(layout);
+        *ptr = 0x41;
+        *ptr.add(1) = 0x42;
+        *ptr.add(2) = 0x43;
+        *ptr.add(3) = 0x44;
+        *ptr.add(16) = 0x00;
+        let val = *(ptr.add(2)); // Accessing previously initialized byte is valid.
+    }
+}
diff --git a/tests/kani/Uninit/alloc-zeroed-to-slice.rs b/tests/kani/Uninit/alloc-zeroed-to-slice.rs
new file mode 100644
index 000000000000..d00ca4c6abff
--- /dev/null
+++ b/tests/kani/Uninit/alloc-zeroed-to-slice.rs
@@ -0,0 +1,22 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::alloc::{alloc_zeroed, Layout};
+use std::slice::from_raw_parts;
+
+#[kani::proof]
+fn alloc_zeroed_to_slice() {
+    let layout = Layout::from_size_align(32, 8).unwrap();
+    unsafe {
+        // This returns initialized memory, so any further accesses are valid.
+        let ptr = alloc_zeroed(layout);
+        *ptr = 0x41;
+        *ptr.add(1) = 0x42;
+        *ptr.add(2) = 0x43;
+        *ptr.add(3) = 0x44;
+        *ptr.add(16) = 0x00;
+        let slice1 = from_raw_parts(ptr, 16);
+        let slice2 = from_raw_parts(ptr.add(16), 16);
+    }
+}
diff --git a/tests/kani/Uninit/atomic.rs b/tests/kani/Uninit/atomic.rs
new file mode 100644
index 000000000000..376f365d408c
--- /dev/null
+++ b/tests/kani/Uninit/atomic.rs
@@ -0,0 +1,66 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::sync::atomic::{AtomicUsize, Ordering};
+
+fn any_ordering() -> Ordering {
+    match kani::any() {
+        0 => Ordering::Relaxed,
+        1 => Ordering::Release,
+        2 => Ordering::Acquire,
+        3 => Ordering::AcqRel,
+        _ => Ordering::SeqCst,
+    }
+}
+
+fn store_ordering() -> Ordering {
+    match kani::any() {
+        0 => Ordering::Relaxed,
+        1 => Ordering::Release,
+        _ => Ordering::SeqCst,
+    }
+}
+
+fn load_ordering() -> Ordering {
+    match kani::any() {
+        0 => Ordering::Relaxed,
+        1 => Ordering::Acquire,
+        _ => Ordering::SeqCst,
+    }
+}
+
+static GLOBAL_ATOMIC: AtomicUsize = AtomicUsize::new(0);
+
+// Checks if memory initialization checks work with atomics defined in the global scope.
+#[kani::proof]
+fn global_atomic() {
+    let old_value = GLOBAL_ATOMIC.fetch_add(1, any_ordering());
+}
+
+// Checks if memory initialization checks work with atomics.
+#[kani::proof]
+fn local_atomic() {
+    // Get a pointer to an allocated value
+    let ptr: *mut usize = Box::into_raw(Box::new(0));
+
+    // Create an atomic from the allocated value
+    let atomic = unsafe { AtomicUsize::from_ptr(ptr) };
+
+    // Use `atomic` for atomic operations
+    atomic.store(1, store_ordering());
+    let old_val = atomic.load(load_ordering());
+    let old_val = atomic.swap(2, any_ordering());
+
+    // Deallocate the value
+    unsafe { drop(Box::from_raw(ptr)) }
+}
+
+// Checks if memory initialization checks work with compare-and-swap atomics.
+#[kani::proof]
+fn compare_exchange_atomic() {
+    // Create an atomic.
+    let some_var = AtomicUsize::new(5);
+    // Perform a `compare-and-swap` operation.
+    some_var.compare_exchange(5, 10, any_ordering(), load_ordering());
+}
diff --git a/tests/kani/Uninit/struct-padding-and-arr-init.rs b/tests/kani/Uninit/struct-padding-and-arr-init.rs
new file mode 100644
index 000000000000..c67b1177bfa3
--- /dev/null
+++ b/tests/kani/Uninit/struct-padding-and-arr-init.rs
@@ -0,0 +1,21 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::ptr::addr_of_mut;
+
+#[repr(C)]
+struct S(u32, u8);
+
+#[kani::proof]
+fn struct_padding_and_arr_init() {
+    unsafe {
+        let mut s = S(0, 0);
+        let sptr = addr_of_mut!(s);
+        let sptr2 = sptr as *mut [u8; 4];
+        *sptr2 = [0; 4];
+        *sptr = S(0, 0);
+        // Both S(u32, u8) and [u8; 4] have the same layout, so the memory is initialized.
+        let val = *sptr2;
+    }
+}
diff --git a/tests/kani/Uninit/vec-read-init.rs b/tests/kani/Uninit/vec-read-init.rs
new file mode 100644
index 000000000000..78812c59830e
--- /dev/null
+++ b/tests/kani/Uninit/vec-read-init.rs
@@ -0,0 +1,11 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+#[kani::proof]
+fn vec_read_init() {
+    let mut v: Vec<u8> = Vec::with_capacity(10);
+    unsafe { *v.as_mut_ptr().add(5) = 0x42 };
+    let def = unsafe { *v.as_ptr().add(5) }; // Accessing previously initialized byte is valid.
+    let x = def + 1;
+}
diff --git a/tests/perf/s2n-quic b/tests/perf/s2n-quic
index 37335c196fb5..f568f269ee5c 160000
--- a/tests/perf/s2n-quic
+++ b/tests/perf/s2n-quic
@@ -1 +1 @@
-Subproject commit 37335c196fb5755dcbe2532e5a3820e46906d5ea
+Subproject commit f568f269ee5c9896f4936089c26dfbb3f87f4dab
diff --git a/tests/script-based-pre/mem-init-reinstrumentation/alloc-zeroed.rs b/tests/script-based-pre/mem-init-reinstrumentation/alloc-zeroed.rs
new file mode 100644
index 000000000000..891a97fd8c22
--- /dev/null
+++ b/tests/script-based-pre/mem-init-reinstrumentation/alloc-zeroed.rs
@@ -0,0 +1,22 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Z uninit-checks
+
+use std::alloc::{alloc_zeroed, Layout};
+use std::slice::from_raw_parts;
+
+#[kani::proof]
+fn alloc_zeroed_to_slice() {
+    let layout = Layout::from_size_align(32, 8).unwrap();
+    unsafe {
+        // This returns initialized memory, so any further accesses are valid.
+        let ptr = alloc_zeroed(layout);
+        *ptr = 0x41;
+        *ptr.add(1) = 0x42;
+        *ptr.add(2) = 0x43;
+        *ptr.add(3) = 0x44;
+        *ptr.add(16) = 0x00;
+        let _slice1 = from_raw_parts(ptr, 16);
+        let _slice2 = from_raw_parts(ptr.add(16), 16);
+    }
+}
diff --git a/tests/script-based-pre/mem-init-reinstrumentation/config.yml b/tests/script-based-pre/mem-init-reinstrumentation/config.yml
new file mode 100644
index 000000000000..ef61a9171954
--- /dev/null
+++ b/tests/script-based-pre/mem-init-reinstrumentation/config.yml
@@ -0,0 +1,4 @@
+# Copyright Kani Contributors
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+script: mem-init-reinstrumentation.sh
+expected: mem-init-reinstrumentation.expected
diff --git a/tests/script-based-pre/mem-init-reinstrumentation/mem-init-reinstrumentation.expected b/tests/script-based-pre/mem-init-reinstrumentation/mem-init-reinstrumentation.expected
new file mode 100644
index 000000000000..59b64322ad50
--- /dev/null
+++ b/tests/script-based-pre/mem-init-reinstrumentation/mem-init-reinstrumentation.expected
@@ -0,0 +1 @@
+success: no pointer checks are detected in initialized memory instrumentaiton
diff --git a/tests/script-based-pre/mem-init-reinstrumentation/mem-init-reinstrumentation.sh b/tests/script-based-pre/mem-init-reinstrumentation/mem-init-reinstrumentation.sh
new file mode 100755
index 000000000000..f859864d1c9a
--- /dev/null
+++ b/tests/script-based-pre/mem-init-reinstrumentation/mem-init-reinstrumentation.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Copyright Kani Contributors
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+
+set -u
+
+KANI_OUTPUT=`kani -Z uninit-checks alloc-zeroed.rs`
+echo "$KANI_OUTPUT" | egrep -q "kani::mem_init::.*pointer_dereference"
+INSTRUMENTATION_DETECTED=$?
+
+if [[ $INSTRUMENTATION_DETECTED == 0 ]]; then
+    echo "failed: pointer checks are detected in initialized memory instrumentaiton"
+    exit 1
+elif [[ $INSTRUMENTATION_DETECTED == 1 ]]; then
+    echo "success: no pointer checks are detected in initialized memory instrumentaiton"
+    exit 0
+else 
+    echo "failed: error occured when runnning egrep"
+    exit 0
+fi
diff --git a/tests/std-checks/core/mem.expected b/tests/std-checks/core/mem.expected
index 8a3b89a8f66a..1484c83901fc 100644
--- a/tests/std-checks/core/mem.expected
+++ b/tests/std-checks/core/mem.expected
@@ -1,3 +1,7 @@
+Checking harness mem::verify::check_swap_unit...
+
+Failed Checks: ptr NULL or writable up to size
+
 Summary:
 Verification failed for - mem::verify::check_swap_unit
-Complete - 3 successfully verified harnesses, 1 failures, 4 total.
+Complete - 6 successfully verified harnesses, 1 failures, 7 total.
diff --git a/tests/std-checks/core/slice.expected b/tests/std-checks/core/slice.expected
new file mode 100644
index 000000000000..4426ff6c02cd
--- /dev/null
+++ b/tests/std-checks/core/slice.expected
@@ -0,0 +1 @@
+Complete - 2 successfully verified harnesses, 0 failures, 2 total.
diff --git a/tests/std-checks/core/src/lib.rs b/tests/std-checks/core/src/lib.rs
index f0e5b480a2d2..b0a4fbc6154f 100644
--- a/tests/std-checks/core/src/lib.rs
+++ b/tests/std-checks/core/src/lib.rs
@@ -7,3 +7,4 @@ extern crate kani;
 
 pub mod mem;
 pub mod ptr;
+pub mod slice;
diff --git a/tests/std-checks/core/src/mem.rs b/tests/std-checks/core/src/mem.rs
index 4f41d176a73a..b0400d0a75f5 100644
--- a/tests/std-checks/core/src/mem.rs
+++ b/tests/std-checks/core/src/mem.rs
@@ -18,6 +18,11 @@ pub mod contracts {
     pub fn swap<T>(x: &mut T, y: &mut T) {
         std::mem::swap(x, y)
     }
+
+    #[kani::modifies(dest)]
+    pub fn replace<T>(dest: &mut T, src: T) -> T {
+        std::mem::replace(dest, src)
+    }
 }
 
 #[cfg(kani)]
@@ -70,4 +75,34 @@ mod verify {
         std::mem::forget(x);
         std::mem::forget(y);
     }
+
+    #[kani::proof_for_contract(contracts::replace)]
+    pub fn check_replace_primitive() {
+        let mut x: u8 = kani::any();
+        let x_before = x;
+
+        let y: u8 = kani::any();
+        let x_returned = contracts::replace(&mut x, y);
+
+        kani::assert(x_before == x_returned, "x_before == x_returned");
+    }
+
+    #[kani::proof_for_contract(contracts::replace)]
+    pub fn check_replace_adt_no_drop() {
+        let mut x: CannotDrop<u8> = kani::any();
+        let y: CannotDrop<u8> = kani::any();
+        let new_x = contracts::replace(&mut x, y);
+        std::mem::forget(x);
+        std::mem::forget(new_x);
+    }
+
+    /// Memory replace logic is optimized according to the size and alignment of a type.
+    #[kani::proof_for_contract(contracts::replace)]
+    pub fn check_replace_large_adt_no_drop() {
+        let mut x: CannotDrop<[u128; 4]> = kani::any();
+        let y: CannotDrop<[u128; 4]> = kani::any();
+        let new_x = contracts::replace(&mut x, y);
+        std::mem::forget(x);
+        std::mem::forget(new_x);
+    }
 }
diff --git a/tests/std-checks/core/src/slice.rs b/tests/std-checks/core/src/slice.rs
new file mode 100644
index 000000000000..fe627f21a5ae
--- /dev/null
+++ b/tests/std-checks/core/src/slice.rs
@@ -0,0 +1,44 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+extern crate kani;
+
+/// Create wrapper functions to standard library functions that contains their contract.
+pub mod contracts {
+    use kani::{mem::*, requires};
+
+    #[requires(can_dereference(std::ptr::slice_from_raw_parts(data, len)))]
+    pub unsafe fn from_raw_parts<'a, T>(data: *const T, len: usize) -> &'a [T] {
+        std::slice::from_raw_parts(data, len)
+    }
+
+    #[requires(can_dereference(std::ptr::slice_from_raw_parts(data, len)))]
+    pub unsafe fn from_raw_parts_mut<'a, T>(data: *mut T, len: usize) -> &'a mut [T] {
+        std::slice::from_raw_parts_mut(data, len)
+    }
+}
+
+#[cfg(kani)]
+mod verify {
+    use super::*;
+
+    const MAX_LEN: usize = isize::MAX as usize;
+
+    #[kani::proof_for_contract(contracts::from_raw_parts)]
+    pub fn check_from_raw_parts_primitive() {
+        let len: usize = kani::any();
+        kani::assume(len < MAX_LEN);
+
+        let arr = vec![0u8; len];
+        let _slice = unsafe { contracts::from_raw_parts(arr.as_ptr(), len) };
+    }
+
+    #[kani::proof_for_contract(contracts::from_raw_parts_mut)]
+    pub fn check_from_raw_parts_mut_primitive() {
+        let len: usize = kani::any();
+        kani::assume(len < MAX_LEN);
+
+        let mut arr = vec![0u8; len];
+        let _slice = unsafe { contracts::from_raw_parts_mut(arr.as_mut_ptr(), len) };
+    }
+}
diff --git a/tests/ui/derive-invariant/helper-empty/expected b/tests/ui/derive-invariant/helper-empty/expected
new file mode 100644
index 000000000000..d8590a9d22b8
--- /dev/null
+++ b/tests/ui/derive-invariant/helper-empty/expected
@@ -0,0 +1,6 @@
+error: Cannot derive impl for `PositivePoint`
+   |
+| #[derive(kani::Invariant)]
+   |          ^^^^^^^^^^^^^^^
+   |
+note: safety constraint in field `x` could not be parsed: expected attribute arguments in parentheses: #[safety_constraint(...)]
diff --git a/tests/ui/derive-invariant/helper-empty/helper-empty.rs b/tests/ui/derive-invariant/helper-empty/helper-empty.rs
new file mode 100644
index 000000000000..3086603cf5db
--- /dev/null
+++ b/tests/ui/derive-invariant/helper-empty/helper-empty.rs
@@ -0,0 +1,17 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Check the compilation error for the `#[safety_constraint(...)]` attribute helper when an
+//! argument isn't provided.
+
+extern crate kani;
+use kani::Invariant;
+
+#[derive(kani::Arbitrary)]
+#[derive(kani::Invariant)]
+struct PositivePoint {
+    #[safety_constraint]
+    x: i32,
+    #[safety_constraint(*y >= 0)]
+    y: i32,
+}
diff --git a/tests/ui/derive-invariant/helper-no-expr/expected b/tests/ui/derive-invariant/helper-no-expr/expected
new file mode 100644
index 000000000000..e9ac7e3e1124
--- /dev/null
+++ b/tests/ui/derive-invariant/helper-no-expr/expected
@@ -0,0 +1,6 @@
+error: Cannot derive impl for `PositivePoint`
+   |
+| #[derive(kani::Invariant)]
+   |          ^^^^^^^^^^^^^^^
+   |
+note: safety constraint in field `x` could not be parsed: unexpected end of input, expected an expression
diff --git a/tests/ui/derive-invariant/helper-no-expr/helper-no-expr.rs b/tests/ui/derive-invariant/helper-no-expr/helper-no-expr.rs
new file mode 100644
index 000000000000..080c94371257
--- /dev/null
+++ b/tests/ui/derive-invariant/helper-no-expr/helper-no-expr.rs
@@ -0,0 +1,17 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Check the compilation error for the `#[safety_constraint(...)]` attribute helper when the
+//! argument is not a proper expression.
+
+extern crate kani;
+use kani::Invariant;
+
+#[derive(kani::Arbitrary)]
+#[derive(kani::Invariant)]
+struct PositivePoint {
+    #[safety_constraint()]
+    x: i32,
+    #[safety_constraint(*y >= 0)]
+    y: i32,
+}
diff --git a/tests/ui/derive-invariant/helper-side-effect/expected b/tests/ui/derive-invariant/helper-side-effect/expected
new file mode 100644
index 000000000000..20b3d17efd38
--- /dev/null
+++ b/tests/ui/derive-invariant/helper-side-effect/expected
@@ -0,0 +1,9 @@
+error[E0596]: cannot borrow `*x` as mutable, as it is behind a `&` reference
+   |
+|     #[safety_constraint({*(x.as_mut()) = 0; true})]
+   |                            ^ `x` is a `&` reference, so the data it refers to cannot be borrowed as mutable
+   |
+help: consider specifying this binding's type
+   |
+|     x: &mut std::boxed::Box<i32>: Box<i32>,
+   |      +++++++++++++++++++++++++++
diff --git a/tests/ui/derive-invariant/helper-side-effect/helper-side-effect.rs b/tests/ui/derive-invariant/helper-side-effect/helper-side-effect.rs
new file mode 100644
index 000000000000..e80f2ff25796
--- /dev/null
+++ b/tests/ui/derive-invariant/helper-side-effect/helper-side-effect.rs
@@ -0,0 +1,22 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Check that side effect expressions in the `#[safety_constraint(...)]`
+//! attribute helpers are not allowed.
+
+extern crate kani;
+use kani::Invariant;
+
+#[derive(kani::Arbitrary)]
+#[derive(kani::Invariant)]
+struct PositivePoint {
+    #[safety_constraint({*(x.as_mut()) = 0; true})]
+    x: Box<i32>,
+    y: i32,
+}
+
+#[kani::proof]
+fn check_invariant_helper_ok() {
+    let pos_point: PositivePoint = kani::any();
+    assert!(pos_point.is_safe());
+}
diff --git a/tests/ui/derive-invariant/helper-wrong-expr/expected b/tests/ui/derive-invariant/helper-wrong-expr/expected
new file mode 100644
index 000000000000..3f661bce9cbb
--- /dev/null
+++ b/tests/ui/derive-invariant/helper-wrong-expr/expected
@@ -0,0 +1,9 @@
+error[E0308]: mismatched types
+   |
+|     #[safety_constraint(x >= 0)]
+   |                              ^ expected `&i32`, found integer
+   |
+help: consider dereferencing the borrow
+   |
+|     #[safety_constraint(*x >= 0)]
+   |
diff --git a/tests/ui/derive-invariant/helper-wrong-expr/helper-wrong-expr.rs b/tests/ui/derive-invariant/helper-wrong-expr/helper-wrong-expr.rs
new file mode 100644
index 000000000000..66b42e02fd68
--- /dev/null
+++ b/tests/ui/derive-invariant/helper-wrong-expr/helper-wrong-expr.rs
@@ -0,0 +1,18 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+//! Check the compilation error for the `#[safety_constraint(...)]` attribute helper when the
+//! argument cannot be evaluated in the struct's context.
+
+extern crate kani;
+use kani::Invariant;
+
+#[derive(kani::Arbitrary)]
+#[derive(kani::Invariant)]
+struct PositivePoint {
+    // Note: `x` is a reference in this context, we should refer to `*x`
+    #[safety_constraint(x >= 0)]
+    x: i32,
+    #[safety_constraint(*y >= 0)]
+    y: i32,
+}
diff --git a/tests/ui/function-contracts/mutating_ensures_error.expected b/tests/ui/function-contracts/mutating_ensures_error.expected
new file mode 100644
index 000000000000..4e9bb3984298
--- /dev/null
+++ b/tests/ui/function-contracts/mutating_ensures_error.expected
@@ -0,0 +1 @@
+cannot assign to `*_x`, as `Fn` closures cannot mutate their captured variables
diff --git a/tests/ui/function-contracts/mutating_ensures_error.rs b/tests/ui/function-contracts/mutating_ensures_error.rs
new file mode 100644
index 000000000000..2fc5f3c8d702
--- /dev/null
+++ b/tests/ui/function-contracts/mutating_ensures_error.rs
@@ -0,0 +1,12 @@
+// Copyright Kani Contributors
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+// kani-flags: -Zfunction-contracts
+
+#[kani::ensures(|_| {*_x += 1; true})]
+fn unit(_x: &mut u32) {}
+
+#[kani::proof_for_contract(id)]
+fn harness() {
+    let mut x = kani::any();
+    unit(&mut x);
+}
diff --git a/tests/ui/function-stubbing-error/main.rs b/tests/ui/function-stubbing-error/main.rs
index 2f5a10ff18cb..c433e352e740 100644
--- a/tests/ui/function-stubbing-error/main.rs
+++ b/tests/ui/function-stubbing-error/main.rs
@@ -1,7 +1,7 @@
 // Copyright Kani Contributors
 // SPDX-License-Identifier: Apache-2.0 OR MIT
 //
-// kani-flags: --harness main --enable-unstable --enable-stubbing
+// kani-flags: --harness main -Z stubbing
 //
 //! This tests whether we detect syntactically misformed `kani::stub` annotations.
 
diff --git a/tests/ui/stubbing/deprecated-enable-stable/deprecated.rs b/tests/ui/stubbing/deprecated-enable-stable/deprecated.rs
deleted file mode 100644
index a5686af20a35..000000000000
--- a/tests/ui/stubbing/deprecated-enable-stable/deprecated.rs
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright Kani Contributors
-// SPDX-License-Identifier: Apache-2.0 OR MIT
-// kani-flags: --enable-unstable --enable-stubbing
-//! Checks that the `kani::stub` attribute is accepted
-
-fn foo() {
-    unreachable!();
-}
-
-fn bar() {}
-
-#[kani::proof]
-#[kani::stub(foo, bar)]
-fn main() {
-    foo();
-}
diff --git a/tests/ui/stubbing/deprecated-enable-stable/expected b/tests/ui/stubbing/deprecated-enable-stable/expected
deleted file mode 100644
index eb05b8cf9812..000000000000
--- a/tests/ui/stubbing/deprecated-enable-stable/expected
+++ /dev/null
@@ -1,2 +0,0 @@
-warning: The `--enable-stubbing` option is deprecated. This option will be removed soon. Consider using `-Z stubbing` instead
-VERIFICATION:- SUCCESSFUL
diff --git a/tests/ui/stubbing/invalid-path/invalid.rs b/tests/ui/stubbing/invalid-path/invalid.rs
index d24c757fd0cd..04d3c786b0d7 100644
--- a/tests/ui/stubbing/invalid-path/invalid.rs
+++ b/tests/ui/stubbing/invalid-path/invalid.rs
@@ -1,7 +1,7 @@
 // Copyright Kani Contributors
 // SPDX-License-Identifier: Apache-2.0 OR MIT
 //
-// kani-flags: --harness invalid_stub --enable-unstable --enable-stubbing
+// kani-flags: --harness invalid_stub -Z stubbing
 
 pub mod mod_a {
     use crate::mod_b::noop;
diff --git a/tests/ui/stubbing/stubbing-flag/main.rs b/tests/ui/stubbing/stubbing-flag/main.rs
index f9b788e94d82..a5172ad9d0cd 100644
--- a/tests/ui/stubbing/stubbing-flag/main.rs
+++ b/tests/ui/stubbing/stubbing-flag/main.rs
@@ -1,9 +1,9 @@
 // Copyright Kani Contributors
 // SPDX-License-Identifier: Apache-2.0 OR MIT
 //
-// kani-flags: --harness main --enable-unstable --enable-stubbing
+// kani-flags: --harness main -Z stubbing
 //
-//! This tests that the `--enable-stubbing` and `--harness` arguments flow from `kani-driver` to `kani-compiler`.
+//! This tests that enabling stubbing and `--harness` argument flow from `kani-driver` to `kani-compiler`.
 
 #[kani::proof]
 fn main() {}
diff --git a/tests/ui/stubbing/stubbing-trait-validation/trait_mismatch.rs b/tests/ui/stubbing/stubbing-trait-validation/trait_mismatch.rs
index e934141664bf..c49552d942e2 100644
--- a/tests/ui/stubbing/stubbing-trait-validation/trait_mismatch.rs
+++ b/tests/ui/stubbing/stubbing-trait-validation/trait_mismatch.rs
@@ -1,7 +1,7 @@
 // Copyright Kani Contributors
 // SPDX-License-Identifier: Apache-2.0 OR MIT
 //
-// kani-flags: --harness harness --enable-unstable --enable-stubbing
+// kani-flags: --harness harness -Z stubbing
 //
 //! This tests that we catch trait mismatches between the stub and the original
 //! function/method. In particular, this tests the case when the program is
diff --git a/tests/ui/stubbing/stubbing-type-validation/type_mismatch.rs b/tests/ui/stubbing/stubbing-type-validation/type_mismatch.rs
index 9f98ae302a22..bc8343658f9e 100644
--- a/tests/ui/stubbing/stubbing-type-validation/type_mismatch.rs
+++ b/tests/ui/stubbing/stubbing-type-validation/type_mismatch.rs
@@ -1,7 +1,7 @@
 // Copyright Kani Contributors
 // SPDX-License-Identifier: Apache-2.0 OR MIT
 //
-// kani-flags: --harness harness --enable-unstable --enable-stubbing
+// kani-flags: --harness harness -Z stubbing
 //
 //! This tests that we catch type mismatches between the stub and the original
 //! function/method.
diff --git a/tools/build-kani/Cargo.toml b/tools/build-kani/Cargo.toml
index 30c2807aa323..7c8e6eef122a 100644
--- a/tools/build-kani/Cargo.toml
+++ b/tools/build-kani/Cargo.toml
@@ -3,7 +3,7 @@
 
 [package]
 name = "build-kani"
-version = "0.52.0"
+version = "0.53.0"
 edition = "2021"
 description = "Builds Kani, Sysroot and release bundle."
 license = "MIT OR Apache-2.0"
diff --git a/tools/compiletest/src/json.rs b/tools/compiletest/src/json.rs
index c46c3b3225e8..89c733abc59a 100644
--- a/tools/compiletest/src/json.rs
+++ b/tools/compiletest/src/json.rs
@@ -35,6 +35,7 @@ struct FutureBreakageItem {
 }
 
 #[derive(Deserialize, Clone)]
+#[allow(dead_code)]
 struct DiagnosticSpanMacroExpansion {
     /// name of macro that was applied (e.g., "foo!" or "#[derive(Eq)]")
     _macro_decl_name: String,