Our CBMC runs don't compute coverage (scripts/tests invokes run-cbmc-proofs with --no-coverage). This is problematic now that e.g. the introduction of alloc/free macros introduces further error paths.

Task: Remove --no-coverage and check which proofs have runtime issues. For those who succeed, find out how the coverage metric can be extracted and we can ensure that the entire function under test was covered.