diff --git a/cfg/posix.cfg b/cfg/posix.cfg
index caa32d8ce..947123ea8 100644
--- a/cfg/posix.cfg
+++ b/cfg/posix.cfg
@@ -3773,17 +3773,17 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="glob">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-null/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="out">
       <not-null/>
       <not-bool/>
     </arg>
@@ -3798,21 +3798,22 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-null/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/wcpncpy.html -->
   <!-- http://man7.org/linux/man-pages/man3/wcpncpy.3.html -->
   <!-- wchar_t *wcpncpy(wchar_t *dest, const wchar_t *src, size_t n); -->
   <function name="wcpncpy">
     <returnValue type="wchar_t *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
       <minsize type="argvalue" arg="3"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>
@@ -3824,15 +3825,15 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
       <minsize type="argvalue" arg="3"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>
@@ -3844,20 +3845,20 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <leak-ignore/>
     <returnValue type="void *"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
       <minsize type="sizeof" arg="2"/>
       <minsize type="argvalue" arg="4"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>
@@ -3870,7 +3871,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <noreturn>false</noreturn>
     <returnValue type="int"/>
     <use-retval/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
@@ -3878,7 +3879,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-uninit/>
       <not-null/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-null/>
       <not-bool/>
@@ -3890,11 +3891,10 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
-      <not-uninit/>
+    <arg nr="2" direction="out">
       <not-null/>
       <not-bool/>
     </arg>
@@ -3905,13 +3905,13 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="out">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -3922,10 +3922,11 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="out">
       <not-bool/>
     </arg>
   </function>
@@ -3935,21 +3936,22 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="out">
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/siglongjmp.html -->
   <!-- void siglongjmp(sigjmp_buf env, int val); -->
   <function name="siglongjmp,_longjmp">
     <returnValue type="void"/>
     <noreturn>true</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -3958,8 +3960,8 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="sigsetjmp,_setjmp">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1"/>
-    <arg nr="2">
+    <arg nr="1" direction="out"/>
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -3969,7 +3971,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-bool/>
     </arg>
@@ -3982,77 +3984,84 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="pthread_sigmask,sigprocmask">
     <noreturn>false</noreturn>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="out">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/getrusage.html -->
   <!-- http://man7.org/linux/man-pages/man2/getrusage.2.html-->
   <!-- int getrusage(int who, struct rusage *usage);-->
   <function name="getrusage">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="out">
       <not-null/>
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/sigemptyset.html -->
   <!-- http://man7.org/linux/man-pages/man3/sigsetops.3.html -->
   <!-- int sigemptyset(sigset_t *set); -->
   <function name="sigemptyset">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/sigfillset.html -->
   <!-- http://man7.org/linux/man-pages/man3/sigsetops.3.html -->
   <!-- int sigfillset(sigset_t *set); -->
   <function name="sigfillset">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/sigaddset.html -->
   <!-- http://man7.org/linux/man-pages/man3/sigsetops.3.html -->
   <!-- int sigaddset(sigset_t *set, int signum); -->
   <function name="sigaddset">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="inout">
+      <not-uninit/>
       <not-null/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/sigdelset.html -->
   <!-- http://man7.org/linux/man-pages/man3/sigsetops.3.html -->
   <!-- int sigdelset(sigset_t *set, int signum);-->
   <function name="sigdelset">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="inout">
       <not-null/>
+      <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -4064,14 +4073,16 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <noreturn>false</noreturn>
     <leak-ignore/>
     <use-retval/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
+      <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/posix_spawn.html -->
   <!-- int posix_spawn(pid_t *restrict pid, const char *restrict path,
                        const posix_spawn_file_actions_t *file_actions,
                        const posix_spawnattr_t *restrict attrp,
@@ -4084,77 +4095,94 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
+    <arg nr="1" direction="out"/>
+    <arg nr="2" direction="in"/>
+    <arg nr="3" direction="in"/>
+    <arg nr="4" direction="in"/>
+    <arg nr="5"/>
     <arg nr="6">
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/msgctl.html -->
   <!-- int msgctl(int msqid, int cmd, struct msqid_ds *buf); -->
   <function name="msgctl">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
     <arg nr="3">
+      <!-- direction (in/out) depends on the value of arg2 "cmd" -->
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/msgget.html -->
   <!-- int msgget(key_t key, int msgflg);-->
   <function name="msgget">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <use-retval/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/msgrcv.html -->
   <!-- ssize_t msgrcv(int msqid, void *msgp, size_t msgsz, long msgtyp,
                int msgflg); -->
   <function name="msgrcv">
     <returnValue type="ssize_t"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="out">
       <not-null/>
+      <minsize type="argvalue" arg="3"/>
+      <!-- TODO: sizeof(long) must be added to this value, but this can not be configured yet -->
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
+      <not-uninit/>
+      <valid>0:</valid>
+    </arg>
+    <arg nr="4" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="4">
-      <not-uninit/>
-    </arg>
-    <arg nr="5">
+    <arg nr="5" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/msgsnd.html -->
   <!-- int msgsnd(int msqid, const void *msgp, size_t msgsz, int msgflg); -->
   <function name="msgsnd">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
-    </arg>
-    <arg nr="3">
       <not-uninit/>
+      <minsize type="argvalue" arg="3"/>
+      <!-- TODO: sizeof(long) must be added to this value, but this can not be configured yet -->
     </arg>
-    <arg nr="4">
+    <arg nr="3" direction="in">
+      <not-uninit/>
+      <valid>0:</valid>
+    </arg>
+    <arg nr="4" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -4165,10 +4193,10 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -4179,38 +4207,40 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/tcsendbreak.html -->
   <!-- http://man7.org/linux/man-pages/man3/tcsendbreak.3p.html -->
   <!-- int tcsendbreak(int fildes, int duration); -->
   <function name="tcsendbreak">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
-      <not-null/>
+    <arg nr="2" direction="in">
+      <not-uninit/>
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/tcgetattr.html -->
   <!-- http://man7.org/linux/man-pages/man3/tcgetattr.3p.html -->
   <!-- int tcgetattr(int fildes, struct termios *termios_p); -->
   <function name="tcgetattr">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="out">
       <not-null/>
       <not-bool/>
     </arg>
@@ -4221,13 +4251,13 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-null/>
       <not-uninit/>
       <not-bool/>
@@ -4241,11 +4271,11 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="inout">
       <not-uninit/>
       <not-null/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -4256,7 +4286,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -4268,24 +4298,28 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <use-retval/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/swab.html -->
   <!-- void swab(const void * src, void* dest, ssize_t bytes); -->
   <function name="swab">
     <returnValue type="void"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
+      <minsize type="argvalue" arg="3"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="out">
       <not-null/>
+      <minsize type="argvalue" arg="3"/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
+      <valid>0:</valid>
     </arg>
   </function>
   <!-- void sync(void); -->
@@ -4293,37 +4327,40 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="void"/>
     <noreturn>false</noreturn>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/gethostname.html -->
   <!-- int gethostname(char *name, size_t len); -->
   <function name="gethostname">
     <noreturn>false</noreturn>
     <returnValue type="int"/>
-    <arg nr="1">
+    <leak-ignore/>
+    <arg nr="1" direction="out">
       <not-null/>
       <minsize type="argvalue" arg="2"/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <valid>1:</valid>
     </arg>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/posix_memalign.html -->
   <!-- int posix_memalign(void **memptr, size_t alignment, size_t size); -->
   <function name="posix_memalign">
     <use-retval/>
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
   </function>
   <memory>
-    <alloc init="false">posix_memalign</alloc>
+    <alloc init="false" arg="1">posix_memalign</alloc>
     <dealloc>free</dealloc>
   </memory>
   <memory>