diff --git a/cfg/posix.cfg b/cfg/posix.cfg
index 1a8aa5afa..383aae70b 100644
--- a/cfg/posix.cfg
+++ b/cfg/posix.cfg
@@ -9,7 +9,7 @@
     <returnValue type="long"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <not-bool/>
@@ -22,7 +22,7 @@
     <returnValue type="char *"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
       <!-- The behavior of l64a() is undefined when value is negative. -->
@@ -36,13 +36,13 @@
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="out">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="inout">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -54,11 +54,11 @@
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-null/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -69,10 +69,10 @@
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="out">
       <not-bool/>
     </arg>
   </function>
@@ -85,15 +85,15 @@
     <noreturn>false</noreturn>
     <returnValue type="int"/>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-bool/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <minsize type="argvalue" arg="3"/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>
@@ -103,32 +103,34 @@
   <function name="connect">
     <noreturn>false</noreturn>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
     </arg>
   </function>
   <!-- see http://pubs.opengroup.org/onlinepubs/9699919799/functions/dlopen.html -->
+  <!-- void *dlopen(const char *file, int mode); -->
   <function name="dlopen">
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="void*"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
   <!-- see http://pubs.opengroup.org/onlinepubs/9699919799/functions/dlsym.html -->
+  <!-- void *dlsym(void *restrict handle, const char *restrict name); -->
   <function name="dlsym">
     <noreturn>false</noreturn>
     <leak-ignore/>
@@ -137,11 +139,12 @@
     <arg nr="1">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
   </function>
   <!-- see http://pubs.opengroup.org/onlinepubs/9699919799/functions/dlclose.html -->
+  <!-- int dlclose(void *handle); -->
   <function name="dlclose">
     <noreturn>false</noreturn>
     <leak-ignore/>
@@ -156,21 +159,21 @@
     <noreturn>false</noreturn>
     <returnValue type="int"/>
     <use-retval/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-bool/>
       <not-uninit/>
     </arg>
   </function>
-  <!-- int dup(int fildes1, int filedes2);
+  <!-- int dup2(int fildes1, int filedes2);
      see http://pubs.opengroup.org/onlinepubs/9699919799/functions/dup.html -->
   <function name="dup2">
     <noreturn>false</noreturn>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-bool/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-bool/>
       <not-uninit/>
     </arg>
@@ -180,8 +183,8 @@
     <noreturn>false</noreturn>
     <returnValue type="int"/>
     <leak-ignore/>
-    <arg nr="1"/>
-    <arg nr="2">
+    <arg nr="1" direction="out"/>
+    <arg nr="2" direction="out">
       <not-bool/>
     </arg>
   </function>
@@ -190,10 +193,10 @@
     <noreturn>false</noreturn>
     <returnValue type="int"/>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -203,10 +206,10 @@
     <noreturn>false</noreturn>
     <returnValue type="void"/>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="inout">
       <not-null/>
     </arg>
   </function>
@@ -215,10 +218,10 @@
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-bool/>
     </arg>
@@ -228,10 +231,10 @@
     <noreturn>false</noreturn>
     <returnValue type="void"/>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="inout">
       <not-null/>
     </arg>
   </function>
@@ -240,7 +243,7 @@
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="void"/>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
     </arg>
   </function>
@@ -250,7 +253,7 @@
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -263,15 +266,15 @@
     <returnValue type="int"/>
     <noreturn>false</noreturn>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-null/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-null/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -282,21 +285,22 @@
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
+  <!-- http://pubs.opengroup.org/onlinepubs/9699919799/functions/truncate.html -->
   <!-- int truncate(const char *path, off_t length); -->
   <function name="truncate">
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -306,10 +310,10 @@
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -319,10 +323,10 @@
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -332,11 +336,11 @@
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
       <not-bool/>
@@ -349,15 +353,15 @@
     because of violations to alloc/dealloc and use-retval configuration-->
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
-    <arg nr="3" default="0">
+    <arg nr="3" default="0" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -367,11 +371,11 @@
     <use-retval/>
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -381,7 +385,7 @@
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="unsigned int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>
@@ -392,7 +396,7 @@
     <noreturn>false</noreturn>
     <returnValue type="int"/>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-bool/>
       <valid>0:999999</valid>
     </arg>
@@ -403,7 +407,7 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
   <function name="_exit">
     <noreturn>true</noreturn>
     <returnValue type="void"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -413,17 +417,17 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -434,7 +438,7 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -445,7 +449,7 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="unsigned int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>
@@ -465,7 +469,7 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="struct rpcent *"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <not-bool/>
@@ -478,7 +482,7 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="struct rpcent *"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -498,7 +502,7 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="struct protoent *"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <not-bool/>
@@ -511,7 +515,7 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="struct protoent *"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -531,11 +535,11 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="struct servent *"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -547,10 +551,10 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="struct servent *"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -570,7 +574,7 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="struct netent *"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <not-bool/>
@@ -583,10 +587,10 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="struct netent *"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -606,7 +610,7 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="struct hostent *"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
       <not-bool/>
@@ -619,11 +623,11 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="struct hostent *"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -635,14 +639,14 @@ The obsolescent function 'usleep' is called. POSIX.1-2001 declares usleep() func
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="struct hostent *"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -1239,11 +1243,11 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
       <not-bool/>
@@ -1256,15 +1260,15 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="int"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-bool/>
       <valid>0:</valid>
     </arg>
@@ -1273,13 +1277,13 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="read">
     <leak-ignore/>
     <returnValue type="ssize_t"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="out">
       <minsize type="argvalue" arg="3"/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>
@@ -1290,14 +1294,14 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <noreturn>false</noreturn>
     <leak-ignore/>
     <returnValue type="ssize_t"/>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <minsize type="argvalue" arg="3"/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
       <valid>0:</valid>