use my{Malloc,Free} in model-checking code