diff --git a/cfg/posix.cfg b/cfg/posix.cfg
index 1f642683b..41b5999eb 100644
--- a/cfg/posix.cfg
+++ b/cfg/posix.cfg
@@ -1529,11 +1529,11 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="syslog">
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
     <formatstr/>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <formatstr/>
     </arg>
     <arg nr="any">
@@ -1544,11 +1544,11 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="vsyslog">
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
     <formatstr/>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <formatstr/>
     </arg>
     <arg nr="any">
@@ -1580,7 +1580,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="pid_t"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1619,7 +1619,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="ppid_t"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1630,7 +1630,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1641,7 +1641,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1652,7 +1652,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1663,7 +1663,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1672,10 +1672,10 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="setpgid">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1684,7 +1684,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="pipe">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-bool/>
     </arg>
   </function>
@@ -1697,23 +1697,23 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <noreturn>false</noreturn>
     <returnValue type="int"/>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-bool/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="inout">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="inout">
       <not-uninit/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="inout">
       <not-uninit/>
     </arg>
-    <arg nr="5">
+    <arg nr="5" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="6">
+    <arg nr="6" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -1723,20 +1723,20 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <noreturn>false</noreturn>
     <returnValue type="int"/>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-bool/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="inout">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="inout">
       <not-uninit/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="inout">
       <not-uninit/>
     </arg>
-    <arg nr="5">
+    <arg nr="5" direction="inout">
       <not-uninit/>
     </arg>
   </function>
@@ -1749,10 +1749,10 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="setregid">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1761,10 +1761,10 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="setreuid">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1774,7 +1774,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1784,7 +1784,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1799,7 +1799,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="getwd">
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
       <not-bool/>
     </arg>
@@ -1811,7 +1811,8 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="htonl">
     <returnValue type="uint32_t"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <use-retval/>
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1820,7 +1821,8 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="htons">
     <returnValue type="uint16_t"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <use-retval/>
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1829,7 +1831,8 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="ntohl">
     <returnValue type="uint32_t"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <use-retval/>
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1838,7 +1841,8 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="ntohs">
     <returnValue type="uint16_t"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <use-retval/>
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1850,7 +1854,8 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <pure/>
     <returnValue type="in_addr_t"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <use-retval/>
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
       <strz/>
@@ -1862,12 +1867,13 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <leak-ignore/>
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <use-retval/>
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
-  <!-- int      mq_close(mqd_t); -->
+  <!-- int mq_close(mqd_t); -->
   <function name="mq_close">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
@@ -1876,18 +1882,18 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-bool/>
     </arg>
   </function>
-  <!-- int      mq_getattr(mqd_t, struct mq_attr *); -->
+  <!-- int mq_getattr(mqd_t, struct mq_attr *); -->
   <function name="mq_getattr">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <arg nr="1">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="out">
       <not-bool/>
     </arg>
   </function>
-  <!-- int      mq_notify(mqd_t, const struct sigevent *); -->
+  <!-- int mq_notify(mqd_t, const struct sigevent *); -->
   <function name="mq_notify">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
@@ -1895,78 +1901,125 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-bool/>
     </arg>
   </function>
-  <!-- mqd_t    mq_open(const char *, int, ...); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/mq_open.html -->
+  <!-- mqd_t mq_open(const char *name, int oflag, ...); -->
   <function name="mq_open">
     <returnValue type="mqd_t"/>
     <noreturn>false</noreturn>
+    <arg nr="1" direction="in">
+      <not-uninit/>
+      <strz/>
+    </arg>
+    <arg nr="2" direction="in">
+      <not-uninit/>
+    </arg>
+    <arg nr="any"/>
   </function>
-  <!-- ssize_t  mq_receive(mqd_t, char *, size_t, unsigned *); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/mq_receive.html -->
+  <!-- ssize_t mq_receive(mqd_t mqdes, char *msg_ptr, size_t msg_len, unsigned *msg_prio); -->
   <function name="mq_receive">
     <returnValue type="ssize_t"/>
     <noreturn>false</noreturn>
     <arg nr="1">
       <not-uninit/>
     </arg>
-    <arg nr="4">
+    <arg nr="2" direction="out">
+      <minsize type="argvalue" arg="3"/>
+    </arg>
+    <arg nr="3" direction="in">
+      <not-uninit/>
+      <valid>0:</valid>
+    </arg>
+    <arg nr="4" direction="out">
       <not-bool/>
     </arg>
   </function>
-  <!-- int      mq_send(mqd_t, const char *, size_t, unsigned); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/mq_send.html -->
+  <!-- int mq_send(mqd_t mqdes, const char *msg_ptr, size_t msg_len, unsigned msg_prio); -->
   <function name="mq_send">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <arg nr="1">
       <not-uninit/>
     </arg>
-    <arg nr="4">
+    <arg nr="2" direction="in">
+      <not-uninit/>
+      <minsize type="argvalue" arg="3"/>
+    </arg>
+    <arg nr="3" direction="in">
+      <not-uninit/>
+    </arg>
+    <arg nr="4" direction="in">
       <not-bool/>
     </arg>
   </function>
-  <!-- int      mq_setattr(mqd_t, const struct mq_attr *restrict,-->
-  <!--             struct mq_attr *restrict); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/mq_setattr.html -->
+  <!-- int mq_setattr(mqd_t mqdes, const struct mq_attr *restrict mqstat, struct mq_attr *restrict omqstat); -->
   <function name="mq_setattr">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <arg nr="1">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="2" direction="in">
+      <not-uninit/>
+    </arg>
+    <arg nr="3" direction="out">
       <not-bool/>
     </arg>
   </function>
-  <!-- ssize_t  mq_timedreceive(mqd_t, char *restrict, size_t,-->
-  <!--             unsigned *restrict, const struct timespec *restrict); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/mq_receive.html -->
+  <!-- ssize_t mq_timedreceive(mqd_t mqdes, char *restrict msg_ptr, size_t msg_len, unsigned *restrict msg_prio, const struct timespec *restrict abstime); -->
   <function name="mq_timedreceive">
     <returnValue type="ssize_t"/>
     <noreturn>false</noreturn>
     <arg nr="1">
       <not-uninit/>
     </arg>
-    <arg nr="5">
+    <arg nr="2" direction="out">
+      <minsize type="argvalue" arg="3"/>
+    </arg>
+    <arg nr="3" direction="in">
+      <not-uninit/>
+    </arg>
+    <arg nr="4" direction="out"/>
+    <arg nr="5" direction="in">
+      <not-uninit/>
       <not-bool/>
     </arg>
   </function>
-  <!-- int      mq_timedsend(mqd_t, const char *, size_t, unsigned,-->
-  <!--             const struct timespec *); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/mq_send.html -->
+  <!-- int mq_timedsend(mqd_t mqdes, const char *msg_ptr, size_t msg_len, unsigned msg_prio, const struct timespec *abstime); -->
   <function name="mq_timedsend">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <arg nr="1">
       <not-uninit/>
     </arg>
-    <arg nr="5">
+    <arg nr="2" direction="in">
+      <not-uninit/>
+      <minsize type="argvalue" arg="3"/>
+    </arg>
+    <arg nr="3" direction="in">
+      <not-uninit/>
+    </arg>
+    <arg nr="4" direction="in">
+      <not-uninit/>
+    </arg>
+    <arg nr="5" direction="in">
+      <not-uninit/>
       <not-bool/>
     </arg>
   </function>
-  <!-- int      mq_unlink(const char *); -->
+  <!-- int mq_unlink(const char *name); -->
   <function name="mq_unlink">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <not-bool/>