diff --git a/cpp/ql/lib/change-notes/2026-08-27-bslx-models.md b/cpp/ql/lib/change-notes/2026-08-27-bslx-models.md
new file mode 100644
index 000000000000..f0905e0ddf41
--- /dev/null
+++ b/cpp/ql/lib/change-notes/2026-08-27-bslx-models.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added taint flow summaries for the BDE `bslx` byte-stream deserializers `BloombergLP::bslx::ByteInStream`, `BloombergLP::bslx::GenericInStream`, and `BloombergLP::bslx::InStreamFunctions::bdexStreamIn`, so that data read from a `bslx` in-stream is tracked as tainted.
diff --git a/cpp/ql/lib/ext/bslx.model.yml b/cpp/ql/lib/ext/bslx.model.yml
new file mode 100644
index 000000000000..02dfd475b1d5
--- /dev/null
+++ b/cpp/ql/lib/ext/bslx.model.yml
@@ -0,0 +1,146 @@
+# Model of the BDE `bslx` byte-stream deserializers (BloombergLP::bslx).
+extensions:
+  - addsTo:
+      pack: codeql/cpp-all
+      extensible: summaryModel
+    data: # namespace, type, subtypes, name, signature, ext, input, output, kind, provenance
+      # === bslx::ByteInStream: concrete byte-array in-stream ===
+      # Taint in: the source buffer/streambuf taints the stream (`this`).
+      # Note: MaD taint is additive, so `reset` cannot clear taint from a previously
+      # tainted stream; a stream reset with a clean buffer keeps any earlier taint.
+      - ["BloombergLP::bslx", "ByteInStream", true, "ByteInStream", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "reset", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      # Taint out: the stream (`this`) taints the deserialized string/array output buffer.
+      # Scalar getters (getLength, getVersion, getInt*, getUint*, getFloat*) are deliberately
+      # not modeled as outputs: most queries sanitize taint through integers, so such rows
+      # would add nothing. Their fluent `ReturnValue[*]` rows below are still modeled.
+      - ["BloombergLP::bslx", "ByteInStream", true, "getString", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayFloat32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayFloat64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      # Fluent interface: each get* returns `*this`, keeping the returned stream tainted.
+      - ["BloombergLP::bslx", "ByteInStream", true, "getLength", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getVersion", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getInt8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getUint8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getInt16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getUint16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getInt24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getUint24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getInt32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getUint32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getInt40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getUint40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getInt48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getUint48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getInt56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getUint56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getInt64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getUint64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getFloat32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getFloat64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getString", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayInt64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayUint64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayFloat32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "ByteInStream", true, "getArrayFloat64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      # === bslx::GenericInStream<STREAMBUF>: streambuf-backed in-stream ===
+      # Taint in: the source buffer/streambuf taints the stream (`this`).
+      - ["BloombergLP::bslx", "GenericInStream", true, "GenericInStream", "", "", "Argument[*0]", "Argument[-1]", "taint", "manual"]
+      # Taint out: the stream (`this`) taints the deserialized string/array output buffer.
+      # Scalar getters (getLength, getVersion, getInt*, getUint*, getFloat*) are deliberately
+      # not modeled as outputs: most queries sanitize taint through integers, so such rows
+      # would add nothing. Their fluent `ReturnValue[*]` rows below are still modeled.
+      - ["BloombergLP::bslx", "GenericInStream", true, "getString", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint8", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint16", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint24", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint40", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint48", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint56", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayFloat32", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayFloat64", "", "", "Argument[-1]", "Argument[*0]", "taint", "manual"]
+      # Fluent interface: each get* returns `*this`, keeping the returned stream tainted.
+      - ["BloombergLP::bslx", "GenericInStream", true, "getLength", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getVersion", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getInt8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getUint8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getInt16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getUint16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getInt24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getUint24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getInt32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getUint32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getInt40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getUint40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getInt48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getUint48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getInt56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getUint56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getInt64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getUint64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getFloat32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getFloat64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getString", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint8", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint16", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint24", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint40", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint48", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint56", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayInt64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayUint64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayFloat32", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      - ["BloombergLP::bslx", "GenericInStream", true, "getArrayFloat64", "", "", "Argument[-1]", "ReturnValue[*]", "taint", "manual"]
+      # === bslx::InStreamFunctions::bdexStreamIn: generic BDEX deserialization ===
+      # Free function template; `InStreamFunctions` is a namespace, so `type` is empty.
+      # Object outputs are modeled in implementations/Bslx.qll, where their type
+      # can be checked to exclude scalar outputs.
+      - ["BloombergLP::bslx::InStreamFunctions", "", false, "bdexStreamIn", "", "", "Argument[*0]", "ReturnValue[*]", "taint", "manual"]
diff --git a/cpp/ql/lib/semmle/code/cpp/models/Models.qll b/cpp/ql/lib/semmle/code/cpp/models/Models.qll
index 54dc0fa0ff64..7f599d6a081c 100644
--- a/cpp/ql/lib/semmle/code/cpp/models/Models.qll
+++ b/cpp/ql/lib/semmle/code/cpp/models/Models.qll
@@ -1,4 +1,5 @@
 private import implementations.Allocation
+private import implementations.Bslx
 private import implementations.Deallocation
 private import implementations.Fopen
 private import implementations.Fread
diff --git a/cpp/ql/lib/semmle/code/cpp/models/implementations/Bslx.qll b/cpp/ql/lib/semmle/code/cpp/models/implementations/Bslx.qll
new file mode 100644
index 000000000000..d47c10956bb2
--- /dev/null
+++ b/cpp/ql/lib/semmle/code/cpp/models/implementations/Bslx.qll
@@ -0,0 +1,16 @@
+/** Provides taint models for BDE BDEX deserialization into objects. */
+
+import semmle.code.cpp.models.interfaces.Taint
+
+private class BdexStreamIn extends TaintFunction {
+  BdexStreamIn() {
+    this.hasQualifiedName("BloombergLP::bslx::InStreamFunctions", "bdexStreamIn") and
+    this.getParameter(1).getUnspecifiedType().(ReferenceType).getBaseType().getUnspecifiedType()
+      instanceof Class
+  }
+
+  override predicate hasTaintFlow(FunctionInput input, FunctionOutput output) {
+    input.isParameterDeref(0) and
+    output.isParameterDeref(1)
+  }
+}
diff --git a/cpp/ql/test/library-tests/dataflow/external-models/bslx.cpp b/cpp/ql/test/library-tests/dataflow/external-models/bslx.cpp
new file mode 100644
index 000000000000..9577fc9a1c84
--- /dev/null
+++ b/cpp/ql/test/library-tests/dataflow/external-models/bslx.cpp
@@ -0,0 +1,299 @@
+
+// --- stub library headers ---
+
+namespace std {
+	typedef unsigned long size_t;
+	template <class T> class allocator {};
+	template<class charT> struct char_traits {};
+	template<class charT, class traits = char_traits<charT>, class Allocator = allocator<charT> >
+	class basic_string {
+	public:
+		basic_string();
+		basic_string(const charT* s, const Allocator& a = Allocator());
+		const charT* data() const;
+		size_t size() const;
+	};
+	typedef basic_string<char> string;
+}
+
+// BDE spells the standard string as `bsl::string`; alias it onto the stub above.
+namespace bsl {
+	using std::string;
+}
+
+// BDE wraps every package-group namespace in `BloombergLP`; this stub reproduces that.
+namespace BloombergLP {
+namespace bsls {
+	// `bsls::Types` provides the fixed-width integer aliases used by the stream API.
+	struct Types {
+		typedef long long Int64;
+		typedef unsigned long long Uint64;
+	};
+}
+namespace bslx {
+	class ByteInStream {
+	public:
+		ByteInStream();
+		ByteInStream(const char *buffer, std::size_t numBytes);
+		void reset(const char *buffer, std::size_t numBytes);
+		ByteInStream &getLength(int &variable);
+		ByteInStream &getVersion(int &variable);
+		ByteInStream &getInt8(char &variable);
+		ByteInStream &getUint8(unsigned char &variable);
+		ByteInStream &getInt16(short &variable);
+		ByteInStream &getUint16(unsigned short &variable);
+		ByteInStream &getInt24(int &variable);
+		ByteInStream &getUint24(unsigned int &variable);
+		ByteInStream &getInt32(int &variable);
+		ByteInStream &getUint32(unsigned int &variable);
+		ByteInStream &getInt40(bsls::Types::Int64 &variable);
+		ByteInStream &getUint40(bsls::Types::Uint64 &variable);
+		ByteInStream &getInt48(bsls::Types::Int64 &variable);
+		ByteInStream &getUint48(bsls::Types::Uint64 &variable);
+		ByteInStream &getInt56(bsls::Types::Int64 &variable);
+		ByteInStream &getUint56(bsls::Types::Uint64 &variable);
+		ByteInStream &getInt64(bsls::Types::Int64 &variable);
+		ByteInStream &getUint64(bsls::Types::Uint64 &variable);
+		ByteInStream &getFloat32(float &variable);
+		ByteInStream &getFloat64(double &variable);
+		ByteInStream &getString(bsl::string &variable);
+		ByteInStream &getArrayInt8(char *variables, int numVariables);
+		ByteInStream &getArrayUint8(unsigned char *variables, int numVariables);
+		ByteInStream &getArrayInt16(short *variables, int numVariables);
+		ByteInStream &getArrayUint16(unsigned short *variables, int numVariables);
+		ByteInStream &getArrayInt24(int *variables, int numVariables);
+		ByteInStream &getArrayUint24(unsigned int *variables, int numVariables);
+		ByteInStream &getArrayInt32(int *variables, int numVariables);
+		ByteInStream &getArrayUint32(unsigned int *variables, int numVariables);
+		ByteInStream &getArrayInt40(bsls::Types::Int64 *variables, int numVariables);
+		ByteInStream &getArrayUint40(bsls::Types::Uint64 *variables, int numVariables);
+		ByteInStream &getArrayInt48(bsls::Types::Int64 *variables, int numVariables);
+		ByteInStream &getArrayUint48(bsls::Types::Uint64 *variables, int numVariables);
+		ByteInStream &getArrayInt56(bsls::Types::Int64 *variables, int numVariables);
+		ByteInStream &getArrayUint56(bsls::Types::Uint64 *variables, int numVariables);
+		ByteInStream &getArrayInt64(bsls::Types::Int64 *variables, int numVariables);
+		ByteInStream &getArrayUint64(bsls::Types::Uint64 *variables, int numVariables);
+		ByteInStream &getArrayFloat32(float *variables, int numVariables);
+		ByteInStream &getArrayFloat64(double *variables, int numVariables);
+	};
+
+	template <class STREAMBUF>
+	class GenericInStream {
+	public:
+		GenericInStream(STREAMBUF *streamBuf);
+		GenericInStream &getLength(int &variable);
+		GenericInStream &getVersion(int &variable);
+		GenericInStream &getInt8(char &variable);
+		GenericInStream &getUint8(unsigned char &variable);
+		GenericInStream &getInt16(short &variable);
+		GenericInStream &getUint16(unsigned short &variable);
+		GenericInStream &getInt24(int &variable);
+		GenericInStream &getUint24(unsigned int &variable);
+		GenericInStream &getInt32(int &variable);
+		GenericInStream &getUint32(unsigned int &variable);
+		GenericInStream &getInt40(bsls::Types::Int64 &variable);
+		GenericInStream &getUint40(bsls::Types::Uint64 &variable);
+		GenericInStream &getInt48(bsls::Types::Int64 &variable);
+		GenericInStream &getUint48(bsls::Types::Uint64 &variable);
+		GenericInStream &getInt56(bsls::Types::Int64 &variable);
+		GenericInStream &getUint56(bsls::Types::Uint64 &variable);
+		GenericInStream &getInt64(bsls::Types::Int64 &variable);
+		GenericInStream &getUint64(bsls::Types::Uint64 &variable);
+		GenericInStream &getFloat32(float &variable);
+		GenericInStream &getFloat64(double &variable);
+		GenericInStream &getString(bsl::string &variable);
+		GenericInStream &getArrayInt8(char *variables, int numVariables);
+		GenericInStream &getArrayUint8(unsigned char *variables, int numVariables);
+		GenericInStream &getArrayInt16(short *variables, int numVariables);
+		GenericInStream &getArrayUint16(unsigned short *variables, int numVariables);
+		GenericInStream &getArrayInt24(int *variables, int numVariables);
+		GenericInStream &getArrayUint24(unsigned int *variables, int numVariables);
+		GenericInStream &getArrayInt32(int *variables, int numVariables);
+		GenericInStream &getArrayUint32(unsigned int *variables, int numVariables);
+		GenericInStream &getArrayInt40(bsls::Types::Int64 *variables, int numVariables);
+		GenericInStream &getArrayUint40(bsls::Types::Uint64 *variables, int numVariables);
+		GenericInStream &getArrayInt48(bsls::Types::Int64 *variables, int numVariables);
+		GenericInStream &getArrayUint48(bsls::Types::Uint64 *variables, int numVariables);
+		GenericInStream &getArrayInt56(bsls::Types::Int64 *variables, int numVariables);
+		GenericInStream &getArrayUint56(bsls::Types::Uint64 *variables, int numVariables);
+		GenericInStream &getArrayInt64(bsls::Types::Int64 *variables, int numVariables);
+		GenericInStream &getArrayUint64(bsls::Types::Uint64 *variables, int numVariables);
+		GenericInStream &getArrayFloat32(float *variables, int numVariables);
+		GenericInStream &getArrayFloat64(double *variables, int numVariables);
+	};
+
+	namespace InStreamFunctions {
+		template <class STREAM, class TYPE>
+		STREAM &bdexStreamIn(STREAM &stream, TYPE &variable);
+		template <class STREAM, class TYPE>
+		STREAM &bdexStreamIn(STREAM &stream, TYPE &variable, int version);
+		template <class STREAM>
+		STREAM &bdexStreamIn(STREAM &stream, int &variable, int version = 0) {
+			return stream.getInt32(variable);
+		}
+	}
+}
+}
+
+struct MyStreamBuf {};
+
+char *source();
+void sink(int);
+void sink(char);
+
+// --- flow tests (source -> sink) ---
+
+void test_ByteInStream_getInt32_no_flow() {
+	std::string data = std::string(source());
+	BloombergLP::bslx::ByteInStream stream(data.data(), data.size());
+	int x = 0;
+	stream.getInt32(x);
+	sink(x); // no flow: scalar outputs are deliberately not modeled
+}
+
+void test_ByteInStream_getArrayInt8() {
+	std::string data = std::string(source());
+	BloombergLP::bslx::ByteInStream stream(data.data(), data.size());
+	char buf[16];
+	stream.getArrayInt8(buf, 16);
+	sink(*buf); // $ ir
+}
+
+void test_ByteInStream_getString() {
+	std::string data = std::string(source());
+	BloombergLP::bslx::ByteInStream stream(data.data(), data.size());
+	std::string out;
+	stream.getString(out);
+	sink(*out.data()); // $ ir
+}
+
+void test_ByteInStream_chained() {
+	std::string data = std::string(source());
+	BloombergLP::bslx::ByteInStream stream(data.data(), data.size());
+	int a = 0;
+	bsl::string out;
+	stream.getInt32(a).getString(out);
+	sink(*out.data()); // $ ir
+}
+
+void test_ByteInStream_reset() {
+	BloombergLP::bslx::ByteInStream stream;
+	std::string data = std::string(source());
+	stream.reset(data.data(), data.size());
+	bsl::string out;
+	stream.getString(out);
+	sink(*out.data()); // $ ir
+}
+
+void test_GenericInStream_flow() {
+	std::string data = std::string(source());
+	MyStreamBuf *sb = (MyStreamBuf *)data.data();
+	BloombergLP::bslx::GenericInStream<MyStreamBuf> stream(sb);
+	bsl::string out;
+	stream.getString(out);
+	sink(*out.data()); // $ ir
+}
+
+void test_GenericInStream_getInt32_no_flow() {
+	std::string data = std::string(source());
+	MyStreamBuf *sb = (MyStreamBuf *)data.data();
+	BloombergLP::bslx::GenericInStream<MyStreamBuf> stream(sb);
+	int x = 0;
+	stream.getInt32(x);
+	sink(x); // no flow: scalar outputs are deliberately not modeled
+}
+
+void test_bdexStreamIn() {
+	std::string data = std::string(source());
+	BloombergLP::bslx::ByteInStream stream(data.data(), data.size());
+	bsl::string obj;
+	BloombergLP::bslx::InStreamFunctions::bdexStreamIn(stream, obj);
+	sink(*obj.data()); // $ ir
+}
+
+// --- coverage: call every modeled getter so steps.ql verifies each row is consumed ---
+
+void coverage_ByteInStream(BloombergLP::bslx::ByteInStream &stream) {
+	int i = 0;
+	unsigned int ui = 0;
+	char c = 0;
+	unsigned char uc = 0;
+	short s = 0;
+	unsigned short us = 0;
+	BloombergLP::bsls::Types::Int64 ll = 0;
+	BloombergLP::bsls::Types::Uint64 ull = 0;
+	float f = 0;
+	double d = 0;
+	bsl::string str;
+	char cbuf[16];
+	unsigned char ucbuf[16];
+	short sbuf[16];
+	unsigned short usbuf[16];
+	int ibuf[16];
+	unsigned int uibuf[16];
+	BloombergLP::bsls::Types::Int64 llbuf[16];
+	BloombergLP::bsls::Types::Uint64 ullbuf[16];
+	float fbuf[16];
+	double dbuf[16];
+	stream.getLength(i).getVersion(i).getInt8(c).getUint8(uc).getInt16(s).getUint16(us).getInt24(i).getUint24(ui).getInt32(i).getUint32(ui).getInt40(ll).getUint40(ull).getInt48(ll).getUint48(ull).getInt56(ll).getUint56(ull).getInt64(ll).getUint64(ull).getFloat32(f).getFloat64(d).getString(str).getArrayInt8(cbuf, 16).getArrayUint8(ucbuf, 16).getArrayInt16(sbuf, 16).getArrayUint16(usbuf, 16).getArrayInt24(ibuf, 16).getArrayUint24(uibuf, 16).getArrayInt32(ibuf, 16).getArrayUint32(uibuf, 16).getArrayInt40(llbuf, 16).getArrayUint40(ullbuf, 16).getArrayInt48(llbuf, 16).getArrayUint48(ullbuf, 16).getArrayInt56(llbuf, 16).getArrayUint56(ullbuf, 16).getArrayInt64(llbuf, 16).getArrayUint64(ullbuf, 16).getArrayFloat32(fbuf, 16).getArrayFloat64(dbuf, 16);
+}
+
+void coverage_GenericInStream(BloombergLP::bslx::GenericInStream<MyStreamBuf> &stream) {
+	int i = 0;
+	unsigned int ui = 0;
+	char c = 0;
+	unsigned char uc = 0;
+	short s = 0;
+	unsigned short us = 0;
+	BloombergLP::bsls::Types::Int64 ll = 0;
+	BloombergLP::bsls::Types::Uint64 ull = 0;
+	float f = 0;
+	double d = 0;
+	bsl::string str;
+	char cbuf[16];
+	unsigned char ucbuf[16];
+	short sbuf[16];
+	unsigned short usbuf[16];
+	int ibuf[16];
+	unsigned int uibuf[16];
+	BloombergLP::bsls::Types::Int64 llbuf[16];
+	BloombergLP::bsls::Types::Uint64 ullbuf[16];
+	float fbuf[16];
+	double dbuf[16];
+	stream.getLength(i).getVersion(i).getInt8(c).getUint8(uc).getInt16(s).getUint16(us).getInt24(i).getUint24(ui).getInt32(i).getUint32(ui).getInt40(ll).getUint40(ull).getInt48(ll).getUint48(ull).getInt56(ll).getUint56(ull).getInt64(ll).getUint64(ull).getFloat32(f).getFloat64(d).getString(str).getArrayInt8(cbuf, 16).getArrayUint8(ucbuf, 16).getArrayInt16(sbuf, 16).getArrayUint16(usbuf, 16).getArrayInt24(ibuf, 16).getArrayUint24(uibuf, 16).getArrayInt32(ibuf, 16).getArrayUint32(uibuf, 16).getArrayInt40(llbuf, 16).getArrayUint40(ullbuf, 16).getArrayInt48(llbuf, 16).getArrayUint48(ullbuf, 16).getArrayInt56(llbuf, 16).getArrayUint56(ullbuf, 16).getArrayInt64(llbuf, 16).getArrayUint64(ullbuf, 16).getArrayFloat32(fbuf, 16).getArrayFloat64(dbuf, 16);
+}
+
+void test_bdexStreamIn_integer_no_flow() {
+	std::string data = std::string(source());
+	BloombergLP::bslx::ByteInStream stream(data.data(), data.size());
+	int x = 0;
+	BloombergLP::bslx::InStreamFunctions::bdexStreamIn(stream, x);
+	sink(x); // no flow: scalar outputs are deliberately not modeled
+	BloombergLP::bslx::InStreamFunctions::bdexStreamIn(stream, x, 0);
+	sink(x); // no flow: the versioned overload must also exclude scalar outputs
+	bsl::string out;
+	BloombergLP::bslx::InStreamFunctions::bdexStreamIn(stream, x, 0).getString(out);
+	sink(*out.data()); // $ ir
+}
+
+void test_bdexStreamIn_versioned_string() {
+	std::string data = std::string(source());
+	BloombergLP::bslx::ByteInStream stream(data.data(), data.size());
+	bsl::string out;
+	BloombergLP::bslx::InStreamFunctions::bdexStreamIn(stream, out, 1);
+	sink(*out.data()); // $ ir
+}
+
+struct BdexObject {
+	int value;
+};
+
+void sink(BdexObject);
+
+void test_bdexStreamIn_object() {
+	std::string data = std::string(source());
+	BloombergLP::bslx::ByteInStream stream(data.data(), data.size());
+	BdexObject out;
+	BloombergLP::bslx::InStreamFunctions::bdexStreamIn(stream, out, 1);
+	sink(out); // $ ir
+}
diff --git a/cpp/ql/test/library-tests/dataflow/external-models/flow.expected b/cpp/ql/test/library-tests/dataflow/external-models/flow.expected
index 43ab7d01c4c4..0ec047772a77 100644
--- a/cpp/ql/test/library-tests/dataflow/external-models/flow.expected
+++ b/cpp/ql/test/library-tests/dataflow/external-models/flow.expected
@@ -102,69 +102,77 @@ models
 | 101 | Summary: BloombergLP::bdlbb; BlobUtil; true; copy; (Blob *,int,const char *,int); ; Argument[*2]; Argument[*0]; taint; manual |
 | 102 | Summary: BloombergLP::bdlbb; BlobUtil; true; copy; (char *,const Blob &,int,int); ; Argument[*1]; Argument[*0]; taint; manual |
 | 103 | Summary: BloombergLP::bdlbb; BlobUtil; true; getContiguousRangeOrCopy; ; ; Argument[*1]; ReturnValue[*]; taint; manual |
-| 104 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,const string &,const string &); ; Argument[*1..2]; ReturnValue; taint; manual |
-| 105 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,const string &,const string &,error_code &); ; Argument[*1..2]; ReturnValue; taint; manual |
-| 106 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,const string &,const string &,flags); ; Argument[*1..2]; ReturnValue; taint; manual |
-| 107 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,const string &,const string &,flags,error_code &); ; Argument[*1..2]; ReturnValue; taint; manual |
-| 108 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,string_view,string_view); ; Argument[1..2]; ReturnValue; taint; manual |
-| 109 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,string_view,string_view,error_code &); ; Argument[1..2]; ReturnValue; taint; manual |
-| 110 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,string_view,string_view,flags); ; Argument[1..2]; ReturnValue; taint; manual |
-| 111 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,string_view,string_view,flags,error_code &); ; Argument[1..2]; ReturnValue; taint; manual |
-| 112 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const string &,const string &); ; Argument[*0..1]; ReturnValue; taint; manual |
-| 113 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const string &,const string &,error_code &); ; Argument[*0..1]; ReturnValue; taint; manual |
-| 114 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const string &,const string &,flags); ; Argument[*0..1]; ReturnValue; taint; manual |
-| 115 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const string &,const string &,flags,error_code &); ; Argument[*0..1]; ReturnValue; taint; manual |
-| 116 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (string_view,string_view); ; Argument[0..1]; ReturnValue; taint; manual |
-| 117 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (string_view,string_view,error_code &); ; Argument[0..1]; ReturnValue; taint; manual |
-| 118 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (string_view,string_view,flags); ; Argument[0..1]; ReturnValue; taint; manual |
-| 119 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (string_view,string_view,flags,error_code &); ; Argument[0..1]; ReturnValue; taint; manual |
-| 120 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual |
-| 121 | Summary: google::protobuf; MessageLite; true; AppendPartialToCord; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 122 | Summary: google::protobuf; MessageLite; true; AppendPartialToString; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 123 | Summary: google::protobuf; MessageLite; true; AppendToCord; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 124 | Summary: google::protobuf; MessageLite; true; AppendToString; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 125 | Summary: google::protobuf; MessageLite; true; MergeFromBoundedZeroCopyStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 126 | Summary: google::protobuf; MessageLite; true; MergeFromCodedStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 127 | Summary: google::protobuf; MessageLite; true; MergeFromCord; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 128 | Summary: google::protobuf; MessageLite; true; MergeFromString; (const Cord &); ; Argument[*0]; Argument[-1]; taint; manual |
-| 129 | Summary: google::protobuf; MessageLite; true; MergeFromString; (string_view); ; Argument[0]; Argument[-1]; taint; manual |
-| 130 | Summary: google::protobuf; MessageLite; true; MergePartialFromBoundedZeroCopyStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 131 | Summary: google::protobuf; MessageLite; true; MergePartialFromCodedStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 132 | Summary: google::protobuf; MessageLite; true; MergePartialFromCord; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 133 | Summary: google::protobuf; MessageLite; true; MergePartialFromString; (const Cord &); ; Argument[*0]; Argument[-1]; taint; manual |
-| 134 | Summary: google::protobuf; MessageLite; true; MergePartialFromString; (string_view); ; Argument[0]; Argument[-1]; taint; manual |
-| 135 | Summary: google::protobuf; MessageLite; true; ParseFromArray; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 136 | Summary: google::protobuf; MessageLite; true; ParseFromBoundedZeroCopyStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 137 | Summary: google::protobuf; MessageLite; true; ParseFromCodedStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 138 | Summary: google::protobuf; MessageLite; true; ParseFromCord; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 139 | Summary: google::protobuf; MessageLite; true; ParseFromIstream; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 140 | Summary: google::protobuf; MessageLite; true; ParseFromString; (const Cord &); ; Argument[*0]; Argument[-1]; taint; manual |
-| 141 | Summary: google::protobuf; MessageLite; true; ParseFromString; (string_view); ; Argument[0]; Argument[-1]; taint; manual |
-| 142 | Summary: google::protobuf; MessageLite; true; ParseFromZeroCopyStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 143 | Summary: google::protobuf; MessageLite; true; ParsePartialFromArray; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 144 | Summary: google::protobuf; MessageLite; true; ParsePartialFromBoundedZeroCopyStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 145 | Summary: google::protobuf; MessageLite; true; ParsePartialFromCodedStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 146 | Summary: google::protobuf; MessageLite; true; ParsePartialFromCord; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 147 | Summary: google::protobuf; MessageLite; true; ParsePartialFromIstream; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 148 | Summary: google::protobuf; MessageLite; true; ParsePartialFromString; (const Cord &); ; Argument[*0]; Argument[-1]; taint; manual |
-| 149 | Summary: google::protobuf; MessageLite; true; ParsePartialFromString; (string_view); ; Argument[0]; Argument[-1]; taint; manual |
-| 150 | Summary: google::protobuf; MessageLite; true; ParsePartialFromZeroCopyStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
-| 151 | Summary: google::protobuf; MessageLite; true; SerializeAsCord; ; ; Argument[-1]; ReturnValue; taint; manual |
-| 152 | Summary: google::protobuf; MessageLite; true; SerializeAsString; ; ; Argument[-1]; ReturnValue; taint; manual |
-| 153 | Summary: google::protobuf; MessageLite; true; SerializePartialAsCord; ; ; Argument[-1]; ReturnValue; taint; manual |
-| 154 | Summary: google::protobuf; MessageLite; true; SerializePartialAsString; ; ; Argument[-1]; ReturnValue; taint; manual |
-| 155 | Summary: google::protobuf; MessageLite; true; SerializePartialToArray; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 156 | Summary: google::protobuf; MessageLite; true; SerializePartialToCodedStream; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 157 | Summary: google::protobuf; MessageLite; true; SerializePartialToCord; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 158 | Summary: google::protobuf; MessageLite; true; SerializePartialToOstream; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 159 | Summary: google::protobuf; MessageLite; true; SerializePartialToString; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 160 | Summary: google::protobuf; MessageLite; true; SerializePartialToZeroCopyStream; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 161 | Summary: google::protobuf; MessageLite; true; SerializeToArray; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 162 | Summary: google::protobuf; MessageLite; true; SerializeToCodedStream; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 163 | Summary: google::protobuf; MessageLite; true; SerializeToCord; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 164 | Summary: google::protobuf; MessageLite; true; SerializeToOstream; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 165 | Summary: google::protobuf; MessageLite; true; SerializeToString; ; ; Argument[-1]; Argument[*0]; taint; manual |
-| 166 | Summary: google::protobuf; MessageLite; true; SerializeToZeroCopyStream; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 104 | Summary: BloombergLP::bslx::InStreamFunctions; ; false; bdexStreamIn; ; ; Argument[*0]; ReturnValue[*]; taint; manual |
+| 105 | Summary: BloombergLP::bslx; ByteInStream; true; ByteInStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 106 | Summary: BloombergLP::bslx; ByteInStream; true; getArrayInt8; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 107 | Summary: BloombergLP::bslx; ByteInStream; true; getInt32; ; ; Argument[-1]; ReturnValue[*]; taint; manual |
+| 108 | Summary: BloombergLP::bslx; ByteInStream; true; getString; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 109 | Summary: BloombergLP::bslx; ByteInStream; true; reset; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 110 | Summary: BloombergLP::bslx; GenericInStream; true; GenericInStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 111 | Summary: BloombergLP::bslx; GenericInStream; true; getString; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 112 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,const string &,const string &); ; Argument[*1..2]; ReturnValue; taint; manual |
+| 113 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,const string &,const string &,error_code &); ; Argument[*1..2]; ReturnValue; taint; manual |
+| 114 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,const string &,const string &,flags); ; Argument[*1..2]; ReturnValue; taint; manual |
+| 115 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,const string &,const string &,flags,error_code &); ; Argument[*1..2]; ReturnValue; taint; manual |
+| 116 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,string_view,string_view); ; Argument[1..2]; ReturnValue; taint; manual |
+| 117 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,string_view,string_view,error_code &); ; Argument[1..2]; ReturnValue; taint; manual |
+| 118 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,string_view,string_view,flags); ; Argument[1..2]; ReturnValue; taint; manual |
+| 119 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const InternetProtocol &,string_view,string_view,flags,error_code &); ; Argument[1..2]; ReturnValue; taint; manual |
+| 120 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const string &,const string &); ; Argument[*0..1]; ReturnValue; taint; manual |
+| 121 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const string &,const string &,error_code &); ; Argument[*0..1]; ReturnValue; taint; manual |
+| 122 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const string &,const string &,flags); ; Argument[*0..1]; ReturnValue; taint; manual |
+| 123 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (const string &,const string &,flags,error_code &); ; Argument[*0..1]; ReturnValue; taint; manual |
+| 124 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (string_view,string_view); ; Argument[0..1]; ReturnValue; taint; manual |
+| 125 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (string_view,string_view,error_code &); ; Argument[0..1]; ReturnValue; taint; manual |
+| 126 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (string_view,string_view,flags); ; Argument[0..1]; ReturnValue; taint; manual |
+| 127 | Summary: boost::asio::ip; basic_resolver<InternetProtocol>; false; resolve; (string_view,string_view,flags,error_code &); ; Argument[0..1]; ReturnValue; taint; manual |
+| 128 | Summary: boost::asio; ; false; buffer; ; ; Argument[*0]; ReturnValue; taint; manual |
+| 129 | Summary: google::protobuf; MessageLite; true; AppendPartialToCord; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 130 | Summary: google::protobuf; MessageLite; true; AppendPartialToString; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 131 | Summary: google::protobuf; MessageLite; true; AppendToCord; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 132 | Summary: google::protobuf; MessageLite; true; AppendToString; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 133 | Summary: google::protobuf; MessageLite; true; MergeFromBoundedZeroCopyStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 134 | Summary: google::protobuf; MessageLite; true; MergeFromCodedStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 135 | Summary: google::protobuf; MessageLite; true; MergeFromCord; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 136 | Summary: google::protobuf; MessageLite; true; MergeFromString; (const Cord &); ; Argument[*0]; Argument[-1]; taint; manual |
+| 137 | Summary: google::protobuf; MessageLite; true; MergeFromString; (string_view); ; Argument[0]; Argument[-1]; taint; manual |
+| 138 | Summary: google::protobuf; MessageLite; true; MergePartialFromBoundedZeroCopyStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 139 | Summary: google::protobuf; MessageLite; true; MergePartialFromCodedStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 140 | Summary: google::protobuf; MessageLite; true; MergePartialFromCord; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 141 | Summary: google::protobuf; MessageLite; true; MergePartialFromString; (const Cord &); ; Argument[*0]; Argument[-1]; taint; manual |
+| 142 | Summary: google::protobuf; MessageLite; true; MergePartialFromString; (string_view); ; Argument[0]; Argument[-1]; taint; manual |
+| 143 | Summary: google::protobuf; MessageLite; true; ParseFromArray; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 144 | Summary: google::protobuf; MessageLite; true; ParseFromBoundedZeroCopyStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 145 | Summary: google::protobuf; MessageLite; true; ParseFromCodedStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 146 | Summary: google::protobuf; MessageLite; true; ParseFromCord; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 147 | Summary: google::protobuf; MessageLite; true; ParseFromIstream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 148 | Summary: google::protobuf; MessageLite; true; ParseFromString; (const Cord &); ; Argument[*0]; Argument[-1]; taint; manual |
+| 149 | Summary: google::protobuf; MessageLite; true; ParseFromString; (string_view); ; Argument[0]; Argument[-1]; taint; manual |
+| 150 | Summary: google::protobuf; MessageLite; true; ParseFromZeroCopyStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 151 | Summary: google::protobuf; MessageLite; true; ParsePartialFromArray; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 152 | Summary: google::protobuf; MessageLite; true; ParsePartialFromBoundedZeroCopyStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 153 | Summary: google::protobuf; MessageLite; true; ParsePartialFromCodedStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 154 | Summary: google::protobuf; MessageLite; true; ParsePartialFromCord; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 155 | Summary: google::protobuf; MessageLite; true; ParsePartialFromIstream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 156 | Summary: google::protobuf; MessageLite; true; ParsePartialFromString; (const Cord &); ; Argument[*0]; Argument[-1]; taint; manual |
+| 157 | Summary: google::protobuf; MessageLite; true; ParsePartialFromString; (string_view); ; Argument[0]; Argument[-1]; taint; manual |
+| 158 | Summary: google::protobuf; MessageLite; true; ParsePartialFromZeroCopyStream; ; ; Argument[*0]; Argument[-1]; taint; manual |
+| 159 | Summary: google::protobuf; MessageLite; true; SerializeAsCord; ; ; Argument[-1]; ReturnValue; taint; manual |
+| 160 | Summary: google::protobuf; MessageLite; true; SerializeAsString; ; ; Argument[-1]; ReturnValue; taint; manual |
+| 161 | Summary: google::protobuf; MessageLite; true; SerializePartialAsCord; ; ; Argument[-1]; ReturnValue; taint; manual |
+| 162 | Summary: google::protobuf; MessageLite; true; SerializePartialAsString; ; ; Argument[-1]; ReturnValue; taint; manual |
+| 163 | Summary: google::protobuf; MessageLite; true; SerializePartialToArray; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 164 | Summary: google::protobuf; MessageLite; true; SerializePartialToCodedStream; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 165 | Summary: google::protobuf; MessageLite; true; SerializePartialToCord; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 166 | Summary: google::protobuf; MessageLite; true; SerializePartialToOstream; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 167 | Summary: google::protobuf; MessageLite; true; SerializePartialToString; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 168 | Summary: google::protobuf; MessageLite; true; SerializePartialToZeroCopyStream; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 169 | Summary: google::protobuf; MessageLite; true; SerializeToArray; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 170 | Summary: google::protobuf; MessageLite; true; SerializeToCodedStream; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 171 | Summary: google::protobuf; MessageLite; true; SerializeToCord; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 172 | Summary: google::protobuf; MessageLite; true; SerializeToOstream; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 173 | Summary: google::protobuf; MessageLite; true; SerializeToString; ; ; Argument[-1]; Argument[*0]; taint; manual |
+| 174 | Summary: google::protobuf; MessageLite; true; SerializeToZeroCopyStream; ; ; Argument[-1]; Argument[*0]; taint; manual |
 edges
 | asio_streams.cpp:116:34:116:44 | read_until output argument | asio_streams.cpp:120:7:120:17 | recv_buffer | provenance | Src:MaD:56  |
 | asio_streams.cpp:116:34:116:44 | read_until output argument | asio_streams.cpp:122:29:122:39 | recv_buffer | provenance | Src:MaD:56 Sink:MaD:4 |
@@ -173,7 +181,7 @@ edges
 | asio_streams.cpp:129:44:129:62 | call to buffer | asio_streams.cpp:129:44:129:62 | call to buffer | provenance |  |
 | asio_streams.cpp:129:44:129:62 | call to buffer | asio_streams.cpp:130:7:130:17 | send_buffer | provenance |  |
 | asio_streams.cpp:129:44:129:62 | call to buffer | asio_streams.cpp:132:29:132:39 | send_buffer | provenance | Sink:MaD:4 |
-| asio_streams.cpp:129:64:129:71 | *send_str | asio_streams.cpp:129:44:129:62 | call to buffer | provenance | MaD:120 |
+| asio_streams.cpp:129:64:129:71 | *send_str | asio_streams.cpp:129:44:129:62 | call to buffer | provenance | MaD:128 |
 | asio_streams.cpp:143:19:143:26 | call to source | asio_streams.cpp:148:24:148:27 | *host | provenance | TaintFunction |
 | asio_streams.cpp:143:19:143:26 | call to source | asio_streams.cpp:149:24:149:27 | *host | provenance | TaintFunction |
 | asio_streams.cpp:143:19:143:26 | call to source | asio_streams.cpp:150:24:150:27 | *host | provenance | TaintFunction |
@@ -190,22 +198,22 @@ edges
 | asio_streams.cpp:145:29:145:36 | call to source | asio_streams.cpp:164:34:164:42 | host_view | provenance | TaintFunction |
 | asio_streams.cpp:145:29:145:36 | call to source | asio_streams.cpp:165:34:165:42 | host_view | provenance | TaintFunction |
 | asio_streams.cpp:145:29:145:36 | call to source | asio_streams.cpp:166:34:166:42 | host_view | provenance | TaintFunction |
-| asio_streams.cpp:148:24:148:27 | *host | asio_streams.cpp:148:16:148:22 | call to resolve | provenance | MaD:112 |
-| asio_streams.cpp:149:24:149:27 | *host | asio_streams.cpp:149:16:149:22 | call to resolve | provenance | MaD:113 |
-| asio_streams.cpp:150:24:150:27 | *host | asio_streams.cpp:150:16:150:22 | call to resolve | provenance | MaD:114 |
-| asio_streams.cpp:151:24:151:27 | *host | asio_streams.cpp:151:16:151:22 | call to resolve | provenance | MaD:115 |
-| asio_streams.cpp:153:24:153:32 | host_view | asio_streams.cpp:153:16:153:22 | call to resolve | provenance | MaD:116 |
-| asio_streams.cpp:154:24:154:32 | host_view | asio_streams.cpp:154:16:154:22 | call to resolve | provenance | MaD:117 |
-| asio_streams.cpp:155:24:155:32 | host_view | asio_streams.cpp:155:16:155:22 | call to resolve | provenance | MaD:118 |
-| asio_streams.cpp:156:24:156:32 | host_view | asio_streams.cpp:156:16:156:22 | call to resolve | provenance | MaD:119 |
-| asio_streams.cpp:158:34:158:37 | *host | asio_streams.cpp:158:16:158:22 | call to resolve | provenance | MaD:104 |
-| asio_streams.cpp:159:34:159:37 | *host | asio_streams.cpp:159:16:159:22 | call to resolve | provenance | MaD:105 |
-| asio_streams.cpp:160:34:160:37 | *host | asio_streams.cpp:160:16:160:22 | call to resolve | provenance | MaD:106 |
-| asio_streams.cpp:161:34:161:37 | *host | asio_streams.cpp:161:16:161:22 | call to resolve | provenance | MaD:107 |
-| asio_streams.cpp:163:34:163:42 | host_view | asio_streams.cpp:163:16:163:22 | call to resolve | provenance | MaD:108 |
-| asio_streams.cpp:164:34:164:42 | host_view | asio_streams.cpp:164:16:164:22 | call to resolve | provenance | MaD:109 |
-| asio_streams.cpp:165:34:165:42 | host_view | asio_streams.cpp:165:16:165:22 | call to resolve | provenance | MaD:110 |
-| asio_streams.cpp:166:34:166:42 | host_view | asio_streams.cpp:166:16:166:22 | call to resolve | provenance | MaD:111 |
+| asio_streams.cpp:148:24:148:27 | *host | asio_streams.cpp:148:16:148:22 | call to resolve | provenance | MaD:120 |
+| asio_streams.cpp:149:24:149:27 | *host | asio_streams.cpp:149:16:149:22 | call to resolve | provenance | MaD:121 |
+| asio_streams.cpp:150:24:150:27 | *host | asio_streams.cpp:150:16:150:22 | call to resolve | provenance | MaD:122 |
+| asio_streams.cpp:151:24:151:27 | *host | asio_streams.cpp:151:16:151:22 | call to resolve | provenance | MaD:123 |
+| asio_streams.cpp:153:24:153:32 | host_view | asio_streams.cpp:153:16:153:22 | call to resolve | provenance | MaD:124 |
+| asio_streams.cpp:154:24:154:32 | host_view | asio_streams.cpp:154:16:154:22 | call to resolve | provenance | MaD:125 |
+| asio_streams.cpp:155:24:155:32 | host_view | asio_streams.cpp:155:16:155:22 | call to resolve | provenance | MaD:126 |
+| asio_streams.cpp:156:24:156:32 | host_view | asio_streams.cpp:156:16:156:22 | call to resolve | provenance | MaD:127 |
+| asio_streams.cpp:158:34:158:37 | *host | asio_streams.cpp:158:16:158:22 | call to resolve | provenance | MaD:112 |
+| asio_streams.cpp:159:34:159:37 | *host | asio_streams.cpp:159:16:159:22 | call to resolve | provenance | MaD:113 |
+| asio_streams.cpp:160:34:160:37 | *host | asio_streams.cpp:160:16:160:22 | call to resolve | provenance | MaD:114 |
+| asio_streams.cpp:161:34:161:37 | *host | asio_streams.cpp:161:16:161:22 | call to resolve | provenance | MaD:115 |
+| asio_streams.cpp:163:34:163:42 | host_view | asio_streams.cpp:163:16:163:22 | call to resolve | provenance | MaD:116 |
+| asio_streams.cpp:164:34:164:42 | host_view | asio_streams.cpp:164:16:164:22 | call to resolve | provenance | MaD:117 |
+| asio_streams.cpp:165:34:165:42 | host_view | asio_streams.cpp:165:16:165:22 | call to resolve | provenance | MaD:118 |
+| asio_streams.cpp:166:34:166:42 | host_view | asio_streams.cpp:166:16:166:22 | call to resolve | provenance | MaD:119 |
 | asio_streams.cpp:175:22:175:29 | call to source | asio_streams.cpp:179:30:179:36 | *service | provenance | TaintFunction |
 | asio_streams.cpp:175:22:175:29 | call to source | asio_streams.cpp:180:30:180:36 | *service | provenance | TaintFunction |
 | asio_streams.cpp:175:22:175:29 | call to source | asio_streams.cpp:181:30:181:36 | *service | provenance | TaintFunction |
@@ -222,22 +230,22 @@ edges
 | asio_streams.cpp:177:32:177:39 | call to source | asio_streams.cpp:195:45:195:56 | service_view | provenance | TaintFunction |
 | asio_streams.cpp:177:32:177:39 | call to source | asio_streams.cpp:196:45:196:56 | service_view | provenance | TaintFunction |
 | asio_streams.cpp:177:32:177:39 | call to source | asio_streams.cpp:197:45:197:56 | service_view | provenance | TaintFunction |
-| asio_streams.cpp:179:30:179:36 | *service | asio_streams.cpp:179:16:179:22 | call to resolve | provenance | MaD:112 |
-| asio_streams.cpp:180:30:180:36 | *service | asio_streams.cpp:180:16:180:22 | call to resolve | provenance | MaD:113 |
-| asio_streams.cpp:181:30:181:36 | *service | asio_streams.cpp:181:16:181:22 | call to resolve | provenance | MaD:114 |
-| asio_streams.cpp:182:30:182:36 | *service | asio_streams.cpp:182:16:182:22 | call to resolve | provenance | MaD:115 |
-| asio_streams.cpp:184:35:184:46 | service_view | asio_streams.cpp:184:16:184:22 | call to resolve | provenance | MaD:116 |
-| asio_streams.cpp:185:35:185:46 | service_view | asio_streams.cpp:185:16:185:22 | call to resolve | provenance | MaD:117 |
-| asio_streams.cpp:186:35:186:46 | service_view | asio_streams.cpp:186:16:186:22 | call to resolve | provenance | MaD:118 |
-| asio_streams.cpp:187:35:187:46 | service_view | asio_streams.cpp:187:16:187:22 | call to resolve | provenance | MaD:119 |
-| asio_streams.cpp:189:40:189:46 | *service | asio_streams.cpp:189:16:189:22 | call to resolve | provenance | MaD:104 |
-| asio_streams.cpp:190:40:190:46 | *service | asio_streams.cpp:190:16:190:22 | call to resolve | provenance | MaD:105 |
-| asio_streams.cpp:191:40:191:46 | *service | asio_streams.cpp:191:16:191:22 | call to resolve | provenance | MaD:106 |
-| asio_streams.cpp:192:40:192:46 | *service | asio_streams.cpp:192:16:192:22 | call to resolve | provenance | MaD:107 |
-| asio_streams.cpp:194:45:194:56 | service_view | asio_streams.cpp:194:16:194:22 | call to resolve | provenance | MaD:108 |
-| asio_streams.cpp:195:45:195:56 | service_view | asio_streams.cpp:195:16:195:22 | call to resolve | provenance | MaD:109 |
-| asio_streams.cpp:196:45:196:56 | service_view | asio_streams.cpp:196:16:196:22 | call to resolve | provenance | MaD:110 |
-| asio_streams.cpp:197:45:197:56 | service_view | asio_streams.cpp:197:16:197:22 | call to resolve | provenance | MaD:111 |
+| asio_streams.cpp:179:30:179:36 | *service | asio_streams.cpp:179:16:179:22 | call to resolve | provenance | MaD:120 |
+| asio_streams.cpp:180:30:180:36 | *service | asio_streams.cpp:180:16:180:22 | call to resolve | provenance | MaD:121 |
+| asio_streams.cpp:181:30:181:36 | *service | asio_streams.cpp:181:16:181:22 | call to resolve | provenance | MaD:122 |
+| asio_streams.cpp:182:30:182:36 | *service | asio_streams.cpp:182:16:182:22 | call to resolve | provenance | MaD:123 |
+| asio_streams.cpp:184:35:184:46 | service_view | asio_streams.cpp:184:16:184:22 | call to resolve | provenance | MaD:124 |
+| asio_streams.cpp:185:35:185:46 | service_view | asio_streams.cpp:185:16:185:22 | call to resolve | provenance | MaD:125 |
+| asio_streams.cpp:186:35:186:46 | service_view | asio_streams.cpp:186:16:186:22 | call to resolve | provenance | MaD:126 |
+| asio_streams.cpp:187:35:187:46 | service_view | asio_streams.cpp:187:16:187:22 | call to resolve | provenance | MaD:127 |
+| asio_streams.cpp:189:40:189:46 | *service | asio_streams.cpp:189:16:189:22 | call to resolve | provenance | MaD:112 |
+| asio_streams.cpp:190:40:190:46 | *service | asio_streams.cpp:190:16:190:22 | call to resolve | provenance | MaD:113 |
+| asio_streams.cpp:191:40:191:46 | *service | asio_streams.cpp:191:16:191:22 | call to resolve | provenance | MaD:114 |
+| asio_streams.cpp:192:40:192:46 | *service | asio_streams.cpp:192:16:192:22 | call to resolve | provenance | MaD:115 |
+| asio_streams.cpp:194:45:194:56 | service_view | asio_streams.cpp:194:16:194:22 | call to resolve | provenance | MaD:116 |
+| asio_streams.cpp:195:45:195:56 | service_view | asio_streams.cpp:195:16:195:22 | call to resolve | provenance | MaD:117 |
+| asio_streams.cpp:196:45:196:56 | service_view | asio_streams.cpp:196:16:196:22 | call to resolve | provenance | MaD:118 |
+| asio_streams.cpp:197:45:197:56 | service_view | asio_streams.cpp:197:16:197:22 | call to resolve | provenance | MaD:119 |
 | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:257:5:257:8 | *resp | provenance |  |
 | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:262:5:262:8 | *resp | provenance |  |
 | azure.cpp:253:48:253:60 | *call to GetBodyStream | azure.cpp:266:38:266:41 | *resp | provenance |  |
@@ -309,200 +317,243 @@ edges
 | bdlbb.cpp:94:46:94:48 | *src | bdlbb.cpp:94:37:94:40 | copy output argument | provenance | MaD:100 |
 | bdlbb.cpp:96:37:96:39 | copy output argument | bdlbb.cpp:97:7:97:10 | * ... | provenance |  |
 | bdlbb.cpp:96:42:96:44 | *dst | bdlbb.cpp:96:37:96:39 | copy output argument | provenance | MaD:102 |
+| bslx.cpp:155:33:155:40 | call to source | bslx.cpp:156:46:156:49 | *call to data | provenance | TaintFunction |
+| bslx.cpp:156:34:156:39 | call to ByteInStream | bslx.cpp:158:2:158:7 | *stream | provenance |  |
+| bslx.cpp:156:46:156:49 | *call to data | bslx.cpp:156:34:156:39 | call to ByteInStream | provenance | MaD:105 |
+| bslx.cpp:158:2:158:7 | *stream | bslx.cpp:158:22:158:24 | getArrayInt8 output argument | provenance | MaD:106 |
+| bslx.cpp:158:22:158:24 | getArrayInt8 output argument | bslx.cpp:159:7:159:10 | * ... | provenance |  |
+| bslx.cpp:163:33:163:40 | call to source | bslx.cpp:164:46:164:49 | *call to data | provenance | TaintFunction |
+| bslx.cpp:164:34:164:39 | call to ByteInStream | bslx.cpp:166:2:166:7 | *stream | provenance |  |
+| bslx.cpp:164:46:164:49 | *call to data | bslx.cpp:164:34:164:39 | call to ByteInStream | provenance | MaD:105 |
+| bslx.cpp:166:2:166:7 | *stream | bslx.cpp:166:19:166:21 | getString output argument | provenance | MaD:108 |
+| bslx.cpp:166:19:166:21 | getString output argument | bslx.cpp:167:7:167:17 | * ... | provenance | TaintFunction |
+| bslx.cpp:171:33:171:40 | call to source | bslx.cpp:172:46:172:49 | *call to data | provenance | TaintFunction |
+| bslx.cpp:172:34:172:39 | call to ByteInStream | bslx.cpp:175:2:175:7 | *stream | provenance |  |
+| bslx.cpp:172:46:172:49 | *call to data | bslx.cpp:172:34:172:39 | call to ByteInStream | provenance | MaD:105 |
+| bslx.cpp:175:2:175:7 | *stream | bslx.cpp:175:17:175:20 | *call to getInt32 | provenance | MaD:107 |
+| bslx.cpp:175:17:175:20 | *call to getInt32 | bslx.cpp:175:31:175:33 | getString output argument | provenance | MaD:108 |
+| bslx.cpp:175:31:175:33 | getString output argument | bslx.cpp:176:7:176:17 | * ... | provenance | TaintFunction |
+| bslx.cpp:181:33:181:40 | call to source | bslx.cpp:182:20:182:23 | *call to data | provenance | TaintFunction |
+| bslx.cpp:182:2:182:7 | reset output argument | bslx.cpp:184:2:184:7 | *stream | provenance |  |
+| bslx.cpp:182:20:182:23 | *call to data | bslx.cpp:182:2:182:7 | reset output argument | provenance | MaD:109 |
+| bslx.cpp:184:2:184:7 | *stream | bslx.cpp:184:19:184:21 | getString output argument | provenance | MaD:108 |
+| bslx.cpp:184:19:184:21 | getString output argument | bslx.cpp:185:7:185:17 | * ... | provenance | TaintFunction |
+| bslx.cpp:189:33:189:40 | call to source | bslx.cpp:190:20:190:45 | *call to data | provenance | TaintFunction |
+| bslx.cpp:190:20:190:45 | *call to data | bslx.cpp:191:57:191:58 | *sb | provenance |  |
+| bslx.cpp:190:20:190:45 | *call to data | bslx.cpp:193:2:193:7 | *stream | provenance | TaintFunction |
+| bslx.cpp:191:50:191:55 | call to GenericInStream | bslx.cpp:193:2:193:7 | *stream | provenance |  |
+| bslx.cpp:191:57:191:58 | *sb | bslx.cpp:191:50:191:55 | call to GenericInStream | provenance | MaD:110 |
+| bslx.cpp:193:2:193:7 | *stream | bslx.cpp:193:19:193:21 | getString output argument | provenance | MaD:111 |
+| bslx.cpp:193:19:193:21 | getString output argument | bslx.cpp:194:7:194:17 | * ... | provenance | TaintFunction |
+| bslx.cpp:207:33:207:40 | call to source | bslx.cpp:208:46:208:49 | *call to data | provenance | TaintFunction |
+| bslx.cpp:208:34:208:39 | call to ByteInStream | bslx.cpp:211:7:211:17 | * ... | provenance | TaintFunction |
+| bslx.cpp:208:46:208:49 | *call to data | bslx.cpp:208:34:208:39 | call to ByteInStream | provenance | MaD:105 |
+| bslx.cpp:267:33:267:40 | call to source | bslx.cpp:268:46:268:49 | *call to data | provenance | TaintFunction |
+| bslx.cpp:268:34:268:39 | call to ByteInStream | bslx.cpp:275:53:275:58 | *stream | provenance |  |
+| bslx.cpp:268:46:268:49 | *call to data | bslx.cpp:268:34:268:39 | call to ByteInStream | provenance | MaD:105 |
+| bslx.cpp:275:52:275:66 | *call to bdexStreamIn | bslx.cpp:275:77:275:79 | getString output argument | provenance | MaD:108 |
+| bslx.cpp:275:53:275:58 | *stream | bslx.cpp:275:52:275:66 | *call to bdexStreamIn | provenance | MaD:104 |
+| bslx.cpp:275:77:275:79 | getString output argument | bslx.cpp:276:7:276:17 | * ... | provenance | TaintFunction |
+| bslx.cpp:280:33:280:40 | call to source | bslx.cpp:281:46:281:49 | *call to data | provenance | TaintFunction |
+| bslx.cpp:281:34:281:39 | call to ByteInStream | bslx.cpp:284:7:284:17 | * ... | provenance | TaintFunction |
+| bslx.cpp:281:46:281:49 | *call to data | bslx.cpp:281:34:281:39 | call to ByteInStream | provenance | MaD:105 |
+| bslx.cpp:294:33:294:40 | call to source | bslx.cpp:295:46:295:49 | *call to data | provenance | TaintFunction |
+| bslx.cpp:295:34:295:39 | call to ByteInStream | bslx.cpp:298:7:298:9 | out | provenance | TaintFunction |
+| bslx.cpp:295:46:295:49 | *call to data | bslx.cpp:295:34:295:39 | call to ByteInStream | provenance | MaD:105 |
 | protobuf.cpp:117:27:117:51 | call to source | protobuf.cpp:117:27:117:51 | call to source | provenance |  |
 | protobuf.cpp:117:27:117:51 | call to source | protobuf.cpp:118:22:118:25 | data | provenance |  |
 | protobuf.cpp:118:2:118:4 | ParseFromString output argument | protobuf.cpp:119:7:119:9 | msg | provenance |  |
-| protobuf.cpp:118:22:118:25 | data | protobuf.cpp:118:2:118:4 | ParseFromString output argument | provenance | MaD:141 |
+| protobuf.cpp:118:22:118:25 | data | protobuf.cpp:118:2:118:4 | ParseFromString output argument | provenance | MaD:149 |
 | protobuf.cpp:124:20:124:37 | call to source | protobuf.cpp:124:20:124:37 | call to source | provenance |  |
 | protobuf.cpp:124:20:124:37 | call to source | protobuf.cpp:125:22:125:25 | *data | provenance |  |
 | protobuf.cpp:125:2:125:4 | ParseFromString output argument | protobuf.cpp:126:7:126:9 | msg | provenance |  |
-| protobuf.cpp:125:22:125:25 | *data | protobuf.cpp:125:2:125:4 | ParseFromString output argument | provenance | MaD:140 |
+| protobuf.cpp:125:22:125:25 | *data | protobuf.cpp:125:2:125:4 | ParseFromString output argument | provenance | MaD:148 |
 | protobuf.cpp:131:27:131:51 | call to source | protobuf.cpp:131:27:131:51 | call to source | provenance |  |
 | protobuf.cpp:131:27:131:51 | call to source | protobuf.cpp:132:29:132:32 | data | provenance |  |
 | protobuf.cpp:132:2:132:4 | ParsePartialFromString output argument | protobuf.cpp:133:7:133:9 | msg | provenance |  |
-| protobuf.cpp:132:29:132:32 | data | protobuf.cpp:132:2:132:4 | ParsePartialFromString output argument | provenance | MaD:149 |
+| protobuf.cpp:132:29:132:32 | data | protobuf.cpp:132:2:132:4 | ParsePartialFromString output argument | provenance | MaD:157 |
 | protobuf.cpp:138:20:138:37 | call to source | protobuf.cpp:138:20:138:37 | call to source | provenance |  |
 | protobuf.cpp:138:20:138:37 | call to source | protobuf.cpp:139:29:139:32 | *data | provenance |  |
 | protobuf.cpp:139:2:139:4 | ParsePartialFromString output argument | protobuf.cpp:140:7:140:9 | msg | provenance |  |
-| protobuf.cpp:139:29:139:32 | *data | protobuf.cpp:139:2:139:4 | ParsePartialFromString output argument | provenance | MaD:148 |
+| protobuf.cpp:139:29:139:32 | *data | protobuf.cpp:139:2:139:4 | ParsePartialFromString output argument | provenance | MaD:156 |
 | protobuf.cpp:145:27:145:51 | call to source | protobuf.cpp:145:27:145:51 | call to source | provenance |  |
 | protobuf.cpp:145:27:145:51 | call to source | protobuf.cpp:146:22:146:25 | data | provenance |  |
 | protobuf.cpp:146:2:146:4 | MergeFromString output argument | protobuf.cpp:147:7:147:9 | msg | provenance |  |
-| protobuf.cpp:146:22:146:25 | data | protobuf.cpp:146:2:146:4 | MergeFromString output argument | provenance | MaD:129 |
+| protobuf.cpp:146:22:146:25 | data | protobuf.cpp:146:2:146:4 | MergeFromString output argument | provenance | MaD:137 |
 | protobuf.cpp:152:20:152:37 | call to source | protobuf.cpp:152:20:152:37 | call to source | provenance |  |
 | protobuf.cpp:152:20:152:37 | call to source | protobuf.cpp:153:22:153:25 | *data | provenance |  |
 | protobuf.cpp:153:2:153:4 | MergeFromString output argument | protobuf.cpp:154:7:154:9 | msg | provenance |  |
-| protobuf.cpp:153:22:153:25 | *data | protobuf.cpp:153:2:153:4 | MergeFromString output argument | provenance | MaD:128 |
+| protobuf.cpp:153:22:153:25 | *data | protobuf.cpp:153:2:153:4 | MergeFromString output argument | provenance | MaD:136 |
 | protobuf.cpp:159:27:159:51 | call to source | protobuf.cpp:159:27:159:51 | call to source | provenance |  |
 | protobuf.cpp:159:27:159:51 | call to source | protobuf.cpp:160:29:160:32 | data | provenance |  |
 | protobuf.cpp:160:2:160:4 | MergePartialFromString output argument | protobuf.cpp:161:7:161:9 | msg | provenance |  |
-| protobuf.cpp:160:29:160:32 | data | protobuf.cpp:160:2:160:4 | MergePartialFromString output argument | provenance | MaD:134 |
+| protobuf.cpp:160:29:160:32 | data | protobuf.cpp:160:2:160:4 | MergePartialFromString output argument | provenance | MaD:142 |
 | protobuf.cpp:166:20:166:37 | call to source | protobuf.cpp:166:20:166:37 | call to source | provenance |  |
 | protobuf.cpp:166:20:166:37 | call to source | protobuf.cpp:167:29:167:32 | *data | provenance |  |
 | protobuf.cpp:167:2:167:4 | MergePartialFromString output argument | protobuf.cpp:168:7:168:9 | msg | provenance |  |
-| protobuf.cpp:167:29:167:32 | *data | protobuf.cpp:167:2:167:4 | MergePartialFromString output argument | provenance | MaD:133 |
+| protobuf.cpp:167:29:167:32 | *data | protobuf.cpp:167:2:167:4 | MergePartialFromString output argument | provenance | MaD:141 |
 | protobuf.cpp:173:19:173:38 | call to source | protobuf.cpp:174:21:174:31 | *call to data | provenance | TaintFunction |
 | protobuf.cpp:174:2:174:4 | ParseFromArray output argument | protobuf.cpp:175:7:175:9 | msg | provenance |  |
-| protobuf.cpp:174:21:174:31 | *call to data | protobuf.cpp:174:2:174:4 | ParseFromArray output argument | provenance | MaD:135 |
+| protobuf.cpp:174:21:174:31 | *call to data | protobuf.cpp:174:2:174:4 | ParseFromArray output argument | provenance | MaD:143 |
 | protobuf.cpp:180:19:180:38 | call to source | protobuf.cpp:181:28:181:38 | *call to data | provenance | TaintFunction |
 | protobuf.cpp:181:2:181:4 | ParsePartialFromArray output argument | protobuf.cpp:182:7:182:9 | msg | provenance |  |
-| protobuf.cpp:181:28:181:38 | *call to data | protobuf.cpp:181:2:181:4 | ParsePartialFromArray output argument | provenance | MaD:143 |
+| protobuf.cpp:181:28:181:38 | *call to data | protobuf.cpp:181:2:181:4 | ParsePartialFromArray output argument | provenance | MaD:151 |
 | protobuf.cpp:187:20:187:37 | call to source | protobuf.cpp:187:20:187:37 | call to source | provenance |  |
 | protobuf.cpp:187:20:187:37 | call to source | protobuf.cpp:188:20:188:23 | *data | provenance |  |
 | protobuf.cpp:188:2:188:4 | ParseFromCord output argument | protobuf.cpp:189:7:189:9 | msg | provenance |  |
-| protobuf.cpp:188:20:188:23 | *data | protobuf.cpp:188:2:188:4 | ParseFromCord output argument | provenance | MaD:138 |
+| protobuf.cpp:188:20:188:23 | *data | protobuf.cpp:188:2:188:4 | ParseFromCord output argument | provenance | MaD:146 |
 | protobuf.cpp:194:20:194:37 | call to source | protobuf.cpp:194:20:194:37 | call to source | provenance |  |
 | protobuf.cpp:194:20:194:37 | call to source | protobuf.cpp:195:27:195:30 | *data | provenance |  |
 | protobuf.cpp:195:2:195:4 | ParsePartialFromCord output argument | protobuf.cpp:196:7:196:9 | msg | provenance |  |
-| protobuf.cpp:195:27:195:30 | *data | protobuf.cpp:195:2:195:4 | ParsePartialFromCord output argument | provenance | MaD:146 |
+| protobuf.cpp:195:27:195:30 | *data | protobuf.cpp:195:2:195:4 | ParsePartialFromCord output argument | provenance | MaD:154 |
 | protobuf.cpp:201:20:201:37 | call to source | protobuf.cpp:201:20:201:37 | call to source | provenance |  |
 | protobuf.cpp:201:20:201:37 | call to source | protobuf.cpp:202:20:202:23 | *data | provenance |  |
 | protobuf.cpp:202:2:202:4 | MergeFromCord output argument | protobuf.cpp:203:7:203:9 | msg | provenance |  |
-| protobuf.cpp:202:20:202:23 | *data | protobuf.cpp:202:2:202:4 | MergeFromCord output argument | provenance | MaD:127 |
+| protobuf.cpp:202:20:202:23 | *data | protobuf.cpp:202:2:202:4 | MergeFromCord output argument | provenance | MaD:135 |
 | protobuf.cpp:208:20:208:37 | call to source | protobuf.cpp:208:20:208:37 | call to source | provenance |  |
 | protobuf.cpp:208:20:208:37 | call to source | protobuf.cpp:209:27:209:30 | *data | provenance |  |
 | protobuf.cpp:209:2:209:4 | MergePartialFromCord output argument | protobuf.cpp:210:7:210:9 | msg | provenance |  |
-| protobuf.cpp:209:27:209:30 | *data | protobuf.cpp:209:2:209:4 | MergePartialFromCord output argument | provenance | MaD:132 |
+| protobuf.cpp:209:27:209:30 | *data | protobuf.cpp:209:2:209:4 | MergePartialFromCord output argument | provenance | MaD:140 |
 | protobuf.cpp:215:20:215:39 | call to source | protobuf.cpp:215:20:215:39 | call to source | provenance |  |
 | protobuf.cpp:215:20:215:39 | call to source | protobuf.cpp:216:23:216:25 | *& ... | provenance |  |
 | protobuf.cpp:216:2:216:4 | ParseFromIstream output argument | protobuf.cpp:217:7:217:9 | msg | provenance |  |
-| protobuf.cpp:216:23:216:25 | *& ... | protobuf.cpp:216:2:216:4 | ParseFromIstream output argument | provenance | MaD:139 |
+| protobuf.cpp:216:23:216:25 | *& ... | protobuf.cpp:216:2:216:4 | ParseFromIstream output argument | provenance | MaD:147 |
 | protobuf.cpp:222:20:222:39 | call to source | protobuf.cpp:222:20:222:39 | call to source | provenance |  |
 | protobuf.cpp:222:20:222:39 | call to source | protobuf.cpp:223:30:223:32 | *& ... | provenance |  |
 | protobuf.cpp:223:2:223:4 | ParsePartialFromIstream output argument | protobuf.cpp:224:7:224:9 | msg | provenance |  |
-| protobuf.cpp:223:30:223:32 | *& ... | protobuf.cpp:223:2:223:4 | ParsePartialFromIstream output argument | provenance | MaD:147 |
+| protobuf.cpp:223:30:223:32 | *& ... | protobuf.cpp:223:2:223:4 | ParsePartialFromIstream output argument | provenance | MaD:155 |
 | protobuf.cpp:229:27:229:53 | call to source | protobuf.cpp:229:27:229:53 | call to source | provenance |  |
 | protobuf.cpp:229:27:229:53 | call to source | protobuf.cpp:230:30:230:32 | *& ... | provenance |  |
 | protobuf.cpp:230:2:230:4 | ParseFromZeroCopyStream output argument | protobuf.cpp:231:7:231:9 | msg | provenance |  |
-| protobuf.cpp:230:30:230:32 | *& ... | protobuf.cpp:230:2:230:4 | ParseFromZeroCopyStream output argument | provenance | MaD:142 |
+| protobuf.cpp:230:30:230:32 | *& ... | protobuf.cpp:230:2:230:4 | ParseFromZeroCopyStream output argument | provenance | MaD:150 |
 | protobuf.cpp:236:27:236:53 | call to source | protobuf.cpp:236:27:236:53 | call to source | provenance |  |
 | protobuf.cpp:236:27:236:53 | call to source | protobuf.cpp:237:37:237:39 | *& ... | provenance |  |
 | protobuf.cpp:237:2:237:4 | ParsePartialFromZeroCopyStream output argument | protobuf.cpp:238:7:238:9 | msg | provenance |  |
-| protobuf.cpp:237:37:237:39 | *& ... | protobuf.cpp:237:2:237:4 | ParsePartialFromZeroCopyStream output argument | provenance | MaD:150 |
+| protobuf.cpp:237:37:237:39 | *& ... | protobuf.cpp:237:2:237:4 | ParsePartialFromZeroCopyStream output argument | provenance | MaD:158 |
 | protobuf.cpp:243:27:243:53 | call to source | protobuf.cpp:243:27:243:53 | call to source | provenance |  |
 | protobuf.cpp:243:27:243:53 | call to source | protobuf.cpp:244:37:244:39 | *& ... | provenance |  |
 | protobuf.cpp:244:2:244:4 | ParseFromBoundedZeroCopyStream output argument | protobuf.cpp:245:7:245:9 | msg | provenance |  |
-| protobuf.cpp:244:37:244:39 | *& ... | protobuf.cpp:244:2:244:4 | ParseFromBoundedZeroCopyStream output argument | provenance | MaD:136 |
+| protobuf.cpp:244:37:244:39 | *& ... | protobuf.cpp:244:2:244:4 | ParseFromBoundedZeroCopyStream output argument | provenance | MaD:144 |
 | protobuf.cpp:250:27:250:53 | call to source | protobuf.cpp:250:27:250:53 | call to source | provenance |  |
 | protobuf.cpp:250:27:250:53 | call to source | protobuf.cpp:251:44:251:46 | *& ... | provenance |  |
 | protobuf.cpp:251:2:251:4 | ParsePartialFromBoundedZeroCopyStream output argument | protobuf.cpp:252:7:252:9 | msg | provenance |  |
-| protobuf.cpp:251:44:251:46 | *& ... | protobuf.cpp:251:2:251:4 | ParsePartialFromBoundedZeroCopyStream output argument | provenance | MaD:144 |
+| protobuf.cpp:251:44:251:46 | *& ... | protobuf.cpp:251:2:251:4 | ParsePartialFromBoundedZeroCopyStream output argument | provenance | MaD:152 |
 | protobuf.cpp:257:27:257:53 | call to source | protobuf.cpp:257:27:257:53 | call to source | provenance |  |
 | protobuf.cpp:257:27:257:53 | call to source | protobuf.cpp:258:37:258:39 | *& ... | provenance |  |
 | protobuf.cpp:258:2:258:4 | MergeFromBoundedZeroCopyStream output argument | protobuf.cpp:259:7:259:9 | msg | provenance |  |
-| protobuf.cpp:258:37:258:39 | *& ... | protobuf.cpp:258:2:258:4 | MergeFromBoundedZeroCopyStream output argument | provenance | MaD:125 |
+| protobuf.cpp:258:37:258:39 | *& ... | protobuf.cpp:258:2:258:4 | MergeFromBoundedZeroCopyStream output argument | provenance | MaD:133 |
 | protobuf.cpp:264:27:264:53 | call to source | protobuf.cpp:264:27:264:53 | call to source | provenance |  |
 | protobuf.cpp:264:27:264:53 | call to source | protobuf.cpp:265:44:265:46 | *& ... | provenance |  |
 | protobuf.cpp:265:2:265:4 | MergePartialFromBoundedZeroCopyStream output argument | protobuf.cpp:266:7:266:9 | msg | provenance |  |
-| protobuf.cpp:265:44:265:46 | *& ... | protobuf.cpp:265:2:265:4 | MergePartialFromBoundedZeroCopyStream output argument | provenance | MaD:130 |
+| protobuf.cpp:265:44:265:46 | *& ... | protobuf.cpp:265:2:265:4 | MergePartialFromBoundedZeroCopyStream output argument | provenance | MaD:138 |
 | protobuf.cpp:271:24:271:47 | call to source | protobuf.cpp:271:24:271:47 | call to source | provenance |  |
 | protobuf.cpp:271:24:271:47 | call to source | protobuf.cpp:272:27:272:29 | *& ... | provenance |  |
 | protobuf.cpp:272:2:272:4 | ParseFromCodedStream output argument | protobuf.cpp:273:7:273:9 | msg | provenance |  |
-| protobuf.cpp:272:27:272:29 | *& ... | protobuf.cpp:272:2:272:4 | ParseFromCodedStream output argument | provenance | MaD:137 |
+| protobuf.cpp:272:27:272:29 | *& ... | protobuf.cpp:272:2:272:4 | ParseFromCodedStream output argument | provenance | MaD:145 |
 | protobuf.cpp:278:24:278:47 | call to source | protobuf.cpp:278:24:278:47 | call to source | provenance |  |
 | protobuf.cpp:278:24:278:47 | call to source | protobuf.cpp:279:34:279:36 | *& ... | provenance |  |
 | protobuf.cpp:279:2:279:4 | ParsePartialFromCodedStream output argument | protobuf.cpp:280:7:280:9 | msg | provenance |  |
-| protobuf.cpp:279:34:279:36 | *& ... | protobuf.cpp:279:2:279:4 | ParsePartialFromCodedStream output argument | provenance | MaD:145 |
+| protobuf.cpp:279:34:279:36 | *& ... | protobuf.cpp:279:2:279:4 | ParsePartialFromCodedStream output argument | provenance | MaD:153 |
 | protobuf.cpp:285:24:285:47 | call to source | protobuf.cpp:285:24:285:47 | call to source | provenance |  |
 | protobuf.cpp:285:24:285:47 | call to source | protobuf.cpp:286:27:286:29 | *& ... | provenance |  |
 | protobuf.cpp:286:2:286:4 | MergeFromCodedStream output argument | protobuf.cpp:287:7:287:9 | msg | provenance |  |
-| protobuf.cpp:286:27:286:29 | *& ... | protobuf.cpp:286:2:286:4 | MergeFromCodedStream output argument | provenance | MaD:126 |
+| protobuf.cpp:286:27:286:29 | *& ... | protobuf.cpp:286:2:286:4 | MergeFromCodedStream output argument | provenance | MaD:134 |
 | protobuf.cpp:292:24:292:47 | call to source | protobuf.cpp:292:24:292:47 | call to source | provenance |  |
 | protobuf.cpp:292:24:292:47 | call to source | protobuf.cpp:293:34:293:36 | *& ... | provenance |  |
 | protobuf.cpp:293:2:293:4 | MergePartialFromCodedStream output argument | protobuf.cpp:294:7:294:9 | msg | provenance |  |
-| protobuf.cpp:293:34:293:36 | *& ... | protobuf.cpp:293:2:293:4 | MergePartialFromCodedStream output argument | provenance | MaD:131 |
+| protobuf.cpp:293:34:293:36 | *& ... | protobuf.cpp:293:2:293:4 | MergePartialFromCodedStream output argument | provenance | MaD:139 |
 | protobuf.cpp:307:15:307:28 | call to source | protobuf.cpp:307:15:307:28 | call to source | provenance |  |
 | protobuf.cpp:307:15:307:28 | call to source | protobuf.cpp:309:2:309:4 | *msg | provenance |  |
-| protobuf.cpp:309:2:309:4 | *msg | protobuf.cpp:309:24:309:27 | SerializeToString output argument | provenance | MaD:165 |
+| protobuf.cpp:309:2:309:4 | *msg | protobuf.cpp:309:24:309:27 | SerializeToString output argument | provenance | MaD:173 |
 | protobuf.cpp:309:24:309:27 | SerializeToString output argument | protobuf.cpp:310:7:310:9 | out | provenance |  |
 | protobuf.cpp:314:15:314:28 | call to source | protobuf.cpp:314:15:314:28 | call to source | provenance |  |
 | protobuf.cpp:314:15:314:28 | call to source | protobuf.cpp:316:2:316:4 | *msg | provenance |  |
-| protobuf.cpp:316:2:316:4 | *msg | protobuf.cpp:316:31:316:34 | SerializePartialToString output argument | provenance | MaD:159 |
+| protobuf.cpp:316:2:316:4 | *msg | protobuf.cpp:316:31:316:34 | SerializePartialToString output argument | provenance | MaD:167 |
 | protobuf.cpp:316:31:316:34 | SerializePartialToString output argument | protobuf.cpp:317:7:317:9 | out | provenance |  |
 | protobuf.cpp:321:15:321:28 | call to source | protobuf.cpp:321:15:321:28 | call to source | provenance |  |
 | protobuf.cpp:321:15:321:28 | call to source | protobuf.cpp:323:2:323:4 | *msg | provenance |  |
-| protobuf.cpp:323:2:323:4 | *msg | protobuf.cpp:323:21:323:24 | AppendToString output argument | provenance | MaD:124 |
+| protobuf.cpp:323:2:323:4 | *msg | protobuf.cpp:323:21:323:24 | AppendToString output argument | provenance | MaD:132 |
 | protobuf.cpp:323:21:323:24 | AppendToString output argument | protobuf.cpp:324:7:324:9 | out | provenance |  |
 | protobuf.cpp:328:15:328:28 | call to source | protobuf.cpp:328:15:328:28 | call to source | provenance |  |
 | protobuf.cpp:328:15:328:28 | call to source | protobuf.cpp:330:2:330:4 | *msg | provenance |  |
-| protobuf.cpp:330:2:330:4 | *msg | protobuf.cpp:330:28:330:31 | AppendPartialToString output argument | provenance | MaD:122 |
+| protobuf.cpp:330:2:330:4 | *msg | protobuf.cpp:330:28:330:31 | AppendPartialToString output argument | provenance | MaD:130 |
 | protobuf.cpp:330:28:330:31 | AppendPartialToString output argument | protobuf.cpp:331:7:331:9 | out | provenance |  |
 | protobuf.cpp:335:15:335:28 | call to source | protobuf.cpp:335:15:335:28 | call to source | provenance |  |
 | protobuf.cpp:335:15:335:28 | call to source | protobuf.cpp:337:2:337:4 | *msg | provenance |  |
-| protobuf.cpp:337:2:337:4 | *msg | protobuf.cpp:337:24:337:27 | SerializeToString output argument | provenance | MaD:165 |
+| protobuf.cpp:337:2:337:4 | *msg | protobuf.cpp:337:24:337:27 | SerializeToString output argument | provenance | MaD:173 |
 | protobuf.cpp:337:24:337:27 | SerializeToString output argument | protobuf.cpp:338:7:338:9 | out | provenance |  |
 | protobuf.cpp:342:15:342:28 | call to source | protobuf.cpp:342:15:342:28 | call to source | provenance |  |
 | protobuf.cpp:342:15:342:28 | call to source | protobuf.cpp:344:2:344:4 | *msg | provenance |  |
-| protobuf.cpp:344:2:344:4 | *msg | protobuf.cpp:344:31:344:34 | SerializePartialToString output argument | provenance | MaD:159 |
+| protobuf.cpp:344:2:344:4 | *msg | protobuf.cpp:344:31:344:34 | SerializePartialToString output argument | provenance | MaD:167 |
 | protobuf.cpp:344:31:344:34 | SerializePartialToString output argument | protobuf.cpp:345:7:345:9 | out | provenance |  |
 | protobuf.cpp:349:15:349:28 | call to source | protobuf.cpp:349:15:349:28 | call to source | provenance |  |
 | protobuf.cpp:349:15:349:28 | call to source | protobuf.cpp:351:2:351:4 | *msg | provenance |  |
-| protobuf.cpp:351:2:351:4 | *msg | protobuf.cpp:351:21:351:24 | AppendToString output argument | provenance | MaD:124 |
+| protobuf.cpp:351:2:351:4 | *msg | protobuf.cpp:351:21:351:24 | AppendToString output argument | provenance | MaD:132 |
 | protobuf.cpp:351:21:351:24 | AppendToString output argument | protobuf.cpp:352:7:352:9 | out | provenance |  |
 | protobuf.cpp:356:15:356:28 | call to source | protobuf.cpp:356:15:356:28 | call to source | provenance |  |
 | protobuf.cpp:356:15:356:28 | call to source | protobuf.cpp:358:2:358:4 | *msg | provenance |  |
-| protobuf.cpp:358:2:358:4 | *msg | protobuf.cpp:358:28:358:31 | AppendPartialToString output argument | provenance | MaD:122 |
+| protobuf.cpp:358:2:358:4 | *msg | protobuf.cpp:358:28:358:31 | AppendPartialToString output argument | provenance | MaD:130 |
 | protobuf.cpp:358:28:358:31 | AppendPartialToString output argument | protobuf.cpp:359:7:359:9 | out | provenance |  |
 | protobuf.cpp:363:15:363:28 | call to source | protobuf.cpp:363:15:363:28 | call to source | provenance |  |
 | protobuf.cpp:363:15:363:28 | call to source | protobuf.cpp:365:2:365:4 | *msg | provenance |  |
-| protobuf.cpp:365:2:365:4 | *msg | protobuf.cpp:365:23:365:25 | SerializeToArray output argument | provenance | MaD:161 |
+| protobuf.cpp:365:2:365:4 | *msg | protobuf.cpp:365:23:365:25 | SerializeToArray output argument | provenance | MaD:169 |
 | protobuf.cpp:365:23:365:25 | SerializeToArray output argument | protobuf.cpp:366:7:366:10 | * ... | provenance |  |
 | protobuf.cpp:370:15:370:28 | call to source | protobuf.cpp:370:15:370:28 | call to source | provenance |  |
 | protobuf.cpp:370:15:370:28 | call to source | protobuf.cpp:372:2:372:4 | *msg | provenance |  |
-| protobuf.cpp:372:2:372:4 | *msg | protobuf.cpp:372:30:372:32 | SerializePartialToArray output argument | provenance | MaD:155 |
+| protobuf.cpp:372:2:372:4 | *msg | protobuf.cpp:372:30:372:32 | SerializePartialToArray output argument | provenance | MaD:163 |
 | protobuf.cpp:372:30:372:32 | SerializePartialToArray output argument | protobuf.cpp:373:7:373:10 | * ... | provenance |  |
 | protobuf.cpp:377:15:377:28 | call to source | protobuf.cpp:377:15:377:28 | call to source | provenance |  |
 | protobuf.cpp:377:15:377:28 | call to source | protobuf.cpp:379:2:379:4 | *msg | provenance |  |
-| protobuf.cpp:379:2:379:4 | *msg | protobuf.cpp:379:22:379:25 | SerializeToCord output argument | provenance | MaD:163 |
+| protobuf.cpp:379:2:379:4 | *msg | protobuf.cpp:379:22:379:25 | SerializeToCord output argument | provenance | MaD:171 |
 | protobuf.cpp:379:22:379:25 | SerializeToCord output argument | protobuf.cpp:380:7:380:9 | out | provenance |  |
 | protobuf.cpp:384:15:384:28 | call to source | protobuf.cpp:384:15:384:28 | call to source | provenance |  |
 | protobuf.cpp:384:15:384:28 | call to source | protobuf.cpp:386:2:386:4 | *msg | provenance |  |
-| protobuf.cpp:386:2:386:4 | *msg | protobuf.cpp:386:29:386:32 | SerializePartialToCord output argument | provenance | MaD:157 |
+| protobuf.cpp:386:2:386:4 | *msg | protobuf.cpp:386:29:386:32 | SerializePartialToCord output argument | provenance | MaD:165 |
 | protobuf.cpp:386:29:386:32 | SerializePartialToCord output argument | protobuf.cpp:387:7:387:9 | out | provenance |  |
 | protobuf.cpp:391:15:391:28 | call to source | protobuf.cpp:391:15:391:28 | call to source | provenance |  |
 | protobuf.cpp:391:15:391:28 | call to source | protobuf.cpp:393:2:393:4 | *msg | provenance |  |
-| protobuf.cpp:393:2:393:4 | *msg | protobuf.cpp:393:19:393:22 | AppendToCord output argument | provenance | MaD:123 |
+| protobuf.cpp:393:2:393:4 | *msg | protobuf.cpp:393:19:393:22 | AppendToCord output argument | provenance | MaD:131 |
 | protobuf.cpp:393:19:393:22 | AppendToCord output argument | protobuf.cpp:394:7:394:9 | out | provenance |  |
 | protobuf.cpp:398:15:398:28 | call to source | protobuf.cpp:398:15:398:28 | call to source | provenance |  |
 | protobuf.cpp:398:15:398:28 | call to source | protobuf.cpp:400:2:400:4 | *msg | provenance |  |
-| protobuf.cpp:400:2:400:4 | *msg | protobuf.cpp:400:26:400:29 | AppendPartialToCord output argument | provenance | MaD:121 |
+| protobuf.cpp:400:2:400:4 | *msg | protobuf.cpp:400:26:400:29 | AppendPartialToCord output argument | provenance | MaD:129 |
 | protobuf.cpp:400:26:400:29 | AppendPartialToCord output argument | protobuf.cpp:401:7:401:9 | out | provenance |  |
 | protobuf.cpp:405:15:405:28 | call to source | protobuf.cpp:405:15:405:28 | call to source | provenance |  |
 | protobuf.cpp:405:15:405:28 | call to source | protobuf.cpp:407:2:407:4 | *msg | provenance |  |
-| protobuf.cpp:407:2:407:4 | *msg | protobuf.cpp:407:25:407:28 | SerializeToOstream output argument | provenance | MaD:164 |
+| protobuf.cpp:407:2:407:4 | *msg | protobuf.cpp:407:25:407:28 | SerializeToOstream output argument | provenance | MaD:172 |
 | protobuf.cpp:407:25:407:28 | SerializeToOstream output argument | protobuf.cpp:408:7:408:9 | out | provenance |  |
 | protobuf.cpp:412:15:412:28 | call to source | protobuf.cpp:412:15:412:28 | call to source | provenance |  |
 | protobuf.cpp:412:15:412:28 | call to source | protobuf.cpp:414:2:414:4 | *msg | provenance |  |
-| protobuf.cpp:414:2:414:4 | *msg | protobuf.cpp:414:32:414:35 | SerializePartialToOstream output argument | provenance | MaD:158 |
+| protobuf.cpp:414:2:414:4 | *msg | protobuf.cpp:414:32:414:35 | SerializePartialToOstream output argument | provenance | MaD:166 |
 | protobuf.cpp:414:32:414:35 | SerializePartialToOstream output argument | protobuf.cpp:415:7:415:9 | out | provenance |  |
 | protobuf.cpp:419:15:419:28 | call to source | protobuf.cpp:419:15:419:28 | call to source | provenance |  |
 | protobuf.cpp:419:15:419:28 | call to source | protobuf.cpp:421:2:421:4 | *msg | provenance |  |
-| protobuf.cpp:421:2:421:4 | *msg | protobuf.cpp:421:32:421:35 | SerializeToZeroCopyStream output argument | provenance | MaD:166 |
+| protobuf.cpp:421:2:421:4 | *msg | protobuf.cpp:421:32:421:35 | SerializeToZeroCopyStream output argument | provenance | MaD:174 |
 | protobuf.cpp:421:32:421:35 | SerializeToZeroCopyStream output argument | protobuf.cpp:422:7:422:9 | out | provenance |  |
 | protobuf.cpp:426:15:426:28 | call to source | protobuf.cpp:426:15:426:28 | call to source | provenance |  |
 | protobuf.cpp:426:15:426:28 | call to source | protobuf.cpp:428:2:428:4 | *msg | provenance |  |
-| protobuf.cpp:428:2:428:4 | *msg | protobuf.cpp:428:39:428:42 | SerializePartialToZeroCopyStream output argument | provenance | MaD:160 |
+| protobuf.cpp:428:2:428:4 | *msg | protobuf.cpp:428:39:428:42 | SerializePartialToZeroCopyStream output argument | provenance | MaD:168 |
 | protobuf.cpp:428:39:428:42 | SerializePartialToZeroCopyStream output argument | protobuf.cpp:429:7:429:9 | out | provenance |  |
 | protobuf.cpp:433:15:433:28 | call to source | protobuf.cpp:433:15:433:28 | call to source | provenance |  |
 | protobuf.cpp:433:15:433:28 | call to source | protobuf.cpp:435:2:435:4 | *msg | provenance |  |
-| protobuf.cpp:435:2:435:4 | *msg | protobuf.cpp:435:29:435:32 | SerializeToCodedStream output argument | provenance | MaD:162 |
+| protobuf.cpp:435:2:435:4 | *msg | protobuf.cpp:435:29:435:32 | SerializeToCodedStream output argument | provenance | MaD:170 |
 | protobuf.cpp:435:29:435:32 | SerializeToCodedStream output argument | protobuf.cpp:436:7:436:9 | out | provenance |  |
 | protobuf.cpp:440:15:440:28 | call to source | protobuf.cpp:440:15:440:28 | call to source | provenance |  |
 | protobuf.cpp:440:15:440:28 | call to source | protobuf.cpp:442:2:442:4 | *msg | provenance |  |
-| protobuf.cpp:442:2:442:4 | *msg | protobuf.cpp:442:36:442:39 | SerializePartialToCodedStream output argument | provenance | MaD:156 |
+| protobuf.cpp:442:2:442:4 | *msg | protobuf.cpp:442:36:442:39 | SerializePartialToCodedStream output argument | provenance | MaD:164 |
 | protobuf.cpp:442:36:442:39 | SerializePartialToCodedStream output argument | protobuf.cpp:443:7:443:9 | out | provenance |  |
 | protobuf.cpp:449:15:449:28 | call to source | protobuf.cpp:449:15:449:28 | call to source | provenance |  |
 | protobuf.cpp:449:15:449:28 | call to source | protobuf.cpp:450:7:450:9 | *msg | provenance |  |
-| protobuf.cpp:450:7:450:9 | *msg | protobuf.cpp:450:11:450:27 | call to SerializeAsString | provenance | MaD:152 |
+| protobuf.cpp:450:7:450:9 | *msg | protobuf.cpp:450:11:450:27 | call to SerializeAsString | provenance | MaD:160 |
 | protobuf.cpp:454:15:454:28 | call to source | protobuf.cpp:454:15:454:28 | call to source | provenance |  |
 | protobuf.cpp:454:15:454:28 | call to source | protobuf.cpp:455:7:455:9 | *msg | provenance |  |
-| protobuf.cpp:455:7:455:9 | *msg | protobuf.cpp:455:11:455:34 | call to SerializePartialAsString | provenance | MaD:154 |
+| protobuf.cpp:455:7:455:9 | *msg | protobuf.cpp:455:11:455:34 | call to SerializePartialAsString | provenance | MaD:162 |
 | protobuf.cpp:459:15:459:28 | call to source | protobuf.cpp:459:15:459:28 | call to source | provenance |  |
 | protobuf.cpp:459:15:459:28 | call to source | protobuf.cpp:460:7:460:9 | *msg | provenance |  |
-| protobuf.cpp:460:7:460:9 | *msg | protobuf.cpp:460:11:460:25 | call to SerializeAsCord | provenance | MaD:151 |
+| protobuf.cpp:460:7:460:9 | *msg | protobuf.cpp:460:11:460:25 | call to SerializeAsCord | provenance | MaD:159 |
 | protobuf.cpp:464:15:464:28 | call to source | protobuf.cpp:464:15:464:28 | call to source | provenance |  |
 | protobuf.cpp:464:15:464:28 | call to source | protobuf.cpp:465:7:465:9 | *msg | provenance |  |
-| protobuf.cpp:465:7:465:9 | *msg | protobuf.cpp:465:11:465:32 | call to SerializePartialAsCord | provenance | MaD:153 |
+| protobuf.cpp:465:7:465:9 | *msg | protobuf.cpp:465:11:465:32 | call to SerializePartialAsCord | provenance | MaD:161 |
 | test.cpp:7:47:7:52 | value2 | test.cpp:7:64:7:69 | value2 | provenance |  |
 | test.cpp:7:64:7:69 | value2 | test.cpp:7:5:7:30 | *ymlStepGenerated_with_body | provenance |  |
 | test.cpp:10:10:10:18 | call to ymlSource | test.cpp:10:10:10:18 | call to ymlSource | provenance | Src:MaD:48  |
@@ -1005,6 +1056,57 @@ nodes
 | bdlbb.cpp:96:37:96:39 | copy output argument | semmle.label | copy output argument |
 | bdlbb.cpp:96:42:96:44 | *dst | semmle.label | *dst |
 | bdlbb.cpp:97:7:97:10 | * ... | semmle.label | * ... |
+| bslx.cpp:155:33:155:40 | call to source | semmle.label | call to source |
+| bslx.cpp:156:34:156:39 | call to ByteInStream | semmle.label | call to ByteInStream |
+| bslx.cpp:156:46:156:49 | *call to data | semmle.label | *call to data |
+| bslx.cpp:158:2:158:7 | *stream | semmle.label | *stream |
+| bslx.cpp:158:22:158:24 | getArrayInt8 output argument | semmle.label | getArrayInt8 output argument |
+| bslx.cpp:159:7:159:10 | * ... | semmle.label | * ... |
+| bslx.cpp:163:33:163:40 | call to source | semmle.label | call to source |
+| bslx.cpp:164:34:164:39 | call to ByteInStream | semmle.label | call to ByteInStream |
+| bslx.cpp:164:46:164:49 | *call to data | semmle.label | *call to data |
+| bslx.cpp:166:2:166:7 | *stream | semmle.label | *stream |
+| bslx.cpp:166:19:166:21 | getString output argument | semmle.label | getString output argument |
+| bslx.cpp:167:7:167:17 | * ... | semmle.label | * ... |
+| bslx.cpp:171:33:171:40 | call to source | semmle.label | call to source |
+| bslx.cpp:172:34:172:39 | call to ByteInStream | semmle.label | call to ByteInStream |
+| bslx.cpp:172:46:172:49 | *call to data | semmle.label | *call to data |
+| bslx.cpp:175:2:175:7 | *stream | semmle.label | *stream |
+| bslx.cpp:175:17:175:20 | *call to getInt32 | semmle.label | *call to getInt32 |
+| bslx.cpp:175:31:175:33 | getString output argument | semmle.label | getString output argument |
+| bslx.cpp:176:7:176:17 | * ... | semmle.label | * ... |
+| bslx.cpp:181:33:181:40 | call to source | semmle.label | call to source |
+| bslx.cpp:182:2:182:7 | reset output argument | semmle.label | reset output argument |
+| bslx.cpp:182:20:182:23 | *call to data | semmle.label | *call to data |
+| bslx.cpp:184:2:184:7 | *stream | semmle.label | *stream |
+| bslx.cpp:184:19:184:21 | getString output argument | semmle.label | getString output argument |
+| bslx.cpp:185:7:185:17 | * ... | semmle.label | * ... |
+| bslx.cpp:189:33:189:40 | call to source | semmle.label | call to source |
+| bslx.cpp:190:20:190:45 | *call to data | semmle.label | *call to data |
+| bslx.cpp:191:50:191:55 | call to GenericInStream | semmle.label | call to GenericInStream |
+| bslx.cpp:191:57:191:58 | *sb | semmle.label | *sb |
+| bslx.cpp:193:2:193:7 | *stream | semmle.label | *stream |
+| bslx.cpp:193:19:193:21 | getString output argument | semmle.label | getString output argument |
+| bslx.cpp:194:7:194:17 | * ... | semmle.label | * ... |
+| bslx.cpp:207:33:207:40 | call to source | semmle.label | call to source |
+| bslx.cpp:208:34:208:39 | call to ByteInStream | semmle.label | call to ByteInStream |
+| bslx.cpp:208:46:208:49 | *call to data | semmle.label | *call to data |
+| bslx.cpp:211:7:211:17 | * ... | semmle.label | * ... |
+| bslx.cpp:267:33:267:40 | call to source | semmle.label | call to source |
+| bslx.cpp:268:34:268:39 | call to ByteInStream | semmle.label | call to ByteInStream |
+| bslx.cpp:268:46:268:49 | *call to data | semmle.label | *call to data |
+| bslx.cpp:275:52:275:66 | *call to bdexStreamIn | semmle.label | *call to bdexStreamIn |
+| bslx.cpp:275:53:275:58 | *stream | semmle.label | *stream |
+| bslx.cpp:275:77:275:79 | getString output argument | semmle.label | getString output argument |
+| bslx.cpp:276:7:276:17 | * ... | semmle.label | * ... |
+| bslx.cpp:280:33:280:40 | call to source | semmle.label | call to source |
+| bslx.cpp:281:34:281:39 | call to ByteInStream | semmle.label | call to ByteInStream |
+| bslx.cpp:281:46:281:49 | *call to data | semmle.label | *call to data |
+| bslx.cpp:284:7:284:17 | * ... | semmle.label | * ... |
+| bslx.cpp:294:33:294:40 | call to source | semmle.label | call to source |
+| bslx.cpp:295:34:295:39 | call to ByteInStream | semmle.label | call to ByteInStream |
+| bslx.cpp:295:46:295:49 | *call to data | semmle.label | *call to data |
+| bslx.cpp:298:7:298:9 | out | semmle.label | out |
 | protobuf.cpp:117:27:117:51 | call to source | semmle.label | call to source |
 | protobuf.cpp:117:27:117:51 | call to source | semmle.label | call to source |
 | protobuf.cpp:118:2:118:4 | ParseFromString output argument | semmle.label | ParseFromString output argument |
diff --git a/cpp/ql/test/library-tests/dataflow/external-models/steps.expected b/cpp/ql/test/library-tests/dataflow/external-models/steps.expected
index 2afe83bbaed7..9290dc8ecf64 100644
--- a/cpp/ql/test/library-tests/dataflow/external-models/steps.expected
+++ b/cpp/ql/test/library-tests/dataflow/external-models/steps.expected
@@ -82,6 +82,155 @@
 | bdlbb.cpp:92:48:92:51 | *call to data | bdlbb.cpp:92:37:92:40 | copy output argument |
 | bdlbb.cpp:94:46:94:48 | *src | bdlbb.cpp:94:37:94:40 | copy output argument |
 | bdlbb.cpp:96:42:96:44 | *dst | bdlbb.cpp:96:37:96:39 | copy output argument |
+| bslx.cpp:132:11:132:16 | *stream | bslx.cpp:132:26:132:36 | *call to getInt32 |
+| bslx.cpp:148:46:148:49 | *call to data | bslx.cpp:148:34:148:39 | call to ByteInStream |
+| bslx.cpp:150:2:150:7 | *stream | bslx.cpp:150:17:150:20 | *call to getInt32 |
+| bslx.cpp:156:46:156:49 | *call to data | bslx.cpp:156:34:156:39 | call to ByteInStream |
+| bslx.cpp:158:2:158:7 | *stream | bslx.cpp:158:21:158:30 | *call to getArrayInt8 |
+| bslx.cpp:158:2:158:7 | *stream | bslx.cpp:158:22:158:24 | getArrayInt8 output argument |
+| bslx.cpp:164:46:164:49 | *call to data | bslx.cpp:164:34:164:39 | call to ByteInStream |
+| bslx.cpp:166:2:166:7 | *stream | bslx.cpp:166:18:166:23 | *call to getString |
+| bslx.cpp:166:2:166:7 | *stream | bslx.cpp:166:19:166:21 | getString output argument |
+| bslx.cpp:172:46:172:49 | *call to data | bslx.cpp:172:34:172:39 | call to ByteInStream |
+| bslx.cpp:175:2:175:7 | *stream | bslx.cpp:175:17:175:20 | *call to getInt32 |
+| bslx.cpp:175:17:175:20 | *call to getInt32 | bslx.cpp:175:30:175:35 | *call to getString |
+| bslx.cpp:175:17:175:20 | *call to getInt32 | bslx.cpp:175:31:175:33 | getString output argument |
+| bslx.cpp:182:20:182:23 | *call to data | bslx.cpp:182:2:182:7 | reset output argument |
+| bslx.cpp:184:2:184:7 | *stream | bslx.cpp:184:18:184:23 | *call to getString |
+| bslx.cpp:184:2:184:7 | *stream | bslx.cpp:184:19:184:21 | getString output argument |
+| bslx.cpp:191:57:191:58 | *sb | bslx.cpp:191:50:191:55 | call to GenericInStream |
+| bslx.cpp:193:2:193:7 | *stream | bslx.cpp:193:18:193:23 | *call to getString |
+| bslx.cpp:193:2:193:7 | *stream | bslx.cpp:193:19:193:21 | getString output argument |
+| bslx.cpp:200:57:200:58 | *sb | bslx.cpp:200:50:200:55 | call to GenericInStream |
+| bslx.cpp:202:2:202:7 | *stream | bslx.cpp:202:17:202:20 | *call to getInt32 |
+| bslx.cpp:208:46:208:49 | *call to data | bslx.cpp:208:34:208:39 | call to ByteInStream |
+| bslx.cpp:210:53:210:58 | *stream | bslx.cpp:210:52:210:65 | *call to bdexStreamIn |
+| bslx.cpp:238:2:238:7 | *stream | bslx.cpp:238:18:238:21 | *call to getLength |
+| bslx.cpp:238:18:238:21 | *call to getLength | bslx.cpp:238:32:238:35 | *call to getVersion |
+| bslx.cpp:238:32:238:35 | *call to getVersion | bslx.cpp:238:43:238:46 | *call to getInt8 |
+| bslx.cpp:238:43:238:46 | *call to getInt8 | bslx.cpp:238:55:238:59 | *call to getUint8 |
+| bslx.cpp:238:55:238:59 | *call to getUint8 | bslx.cpp:238:68:238:71 | *call to getInt16 |
+| bslx.cpp:238:68:238:71 | *call to getInt16 | bslx.cpp:238:81:238:85 | *call to getUint16 |
+| bslx.cpp:238:81:238:85 | *call to getUint16 | bslx.cpp:238:94:238:97 | *call to getInt24 |
+| bslx.cpp:238:94:238:97 | *call to getInt24 | bslx.cpp:238:107:238:111 | *call to getUint24 |
+| bslx.cpp:238:107:238:111 | *call to getUint24 | bslx.cpp:238:120:238:123 | *call to getInt32 |
+| bslx.cpp:238:120:238:123 | *call to getInt32 | bslx.cpp:238:133:238:137 | *call to getUint32 |
+| bslx.cpp:238:133:238:137 | *call to getUint32 | bslx.cpp:238:146:238:150 | *call to getInt40 |
+| bslx.cpp:238:146:238:150 | *call to getInt40 | bslx.cpp:238:160:238:165 | *call to getUint40 |
+| bslx.cpp:238:160:238:165 | *call to getUint40 | bslx.cpp:238:174:238:178 | *call to getInt48 |
+| bslx.cpp:238:174:238:178 | *call to getInt48 | bslx.cpp:238:188:238:193 | *call to getUint48 |
+| bslx.cpp:238:188:238:193 | *call to getUint48 | bslx.cpp:238:202:238:206 | *call to getInt56 |
+| bslx.cpp:238:202:238:206 | *call to getInt56 | bslx.cpp:238:216:238:221 | *call to getUint56 |
+| bslx.cpp:238:216:238:221 | *call to getUint56 | bslx.cpp:238:230:238:234 | *call to getInt64 |
+| bslx.cpp:238:230:238:234 | *call to getInt64 | bslx.cpp:238:244:238:249 | *call to getUint64 |
+| bslx.cpp:238:244:238:249 | *call to getUint64 | bslx.cpp:238:260:238:263 | *call to getFloat32 |
+| bslx.cpp:238:260:238:263 | *call to getFloat32 | bslx.cpp:238:274:238:277 | *call to getFloat64 |
+| bslx.cpp:238:274:238:277 | *call to getFloat64 | bslx.cpp:238:287:238:292 | *call to getString |
+| bslx.cpp:238:274:238:277 | *call to getFloat64 | bslx.cpp:238:288:238:290 | getString output argument |
+| bslx.cpp:238:287:238:292 | *call to getString | bslx.cpp:238:305:238:315 | *call to getArrayInt8 |
+| bslx.cpp:238:287:238:292 | *call to getString | bslx.cpp:238:306:238:309 | getArrayInt8 output argument |
+| bslx.cpp:238:305:238:315 | *call to getArrayInt8 | bslx.cpp:238:329:238:340 | *call to getArrayUint8 |
+| bslx.cpp:238:305:238:315 | *call to getArrayInt8 | bslx.cpp:238:330:238:334 | getArrayUint8 output argument |
+| bslx.cpp:238:329:238:340 | *call to getArrayUint8 | bslx.cpp:238:354:238:364 | *call to getArrayInt16 |
+| bslx.cpp:238:329:238:340 | *call to getArrayUint8 | bslx.cpp:238:355:238:358 | getArrayInt16 output argument |
+| bslx.cpp:238:354:238:364 | *call to getArrayInt16 | bslx.cpp:238:379:238:390 | *call to getArrayUint16 |
+| bslx.cpp:238:354:238:364 | *call to getArrayInt16 | bslx.cpp:238:380:238:384 | getArrayUint16 output argument |
+| bslx.cpp:238:379:238:390 | *call to getArrayUint16 | bslx.cpp:238:404:238:414 | *call to getArrayInt24 |
+| bslx.cpp:238:379:238:390 | *call to getArrayUint16 | bslx.cpp:238:405:238:408 | getArrayInt24 output argument |
+| bslx.cpp:238:404:238:414 | *call to getArrayInt24 | bslx.cpp:238:429:238:440 | *call to getArrayUint24 |
+| bslx.cpp:238:404:238:414 | *call to getArrayInt24 | bslx.cpp:238:430:238:434 | getArrayUint24 output argument |
+| bslx.cpp:238:429:238:440 | *call to getArrayUint24 | bslx.cpp:238:454:238:464 | *call to getArrayInt32 |
+| bslx.cpp:238:429:238:440 | *call to getArrayUint24 | bslx.cpp:238:455:238:458 | getArrayInt32 output argument |
+| bslx.cpp:238:454:238:464 | *call to getArrayInt32 | bslx.cpp:238:479:238:490 | *call to getArrayUint32 |
+| bslx.cpp:238:454:238:464 | *call to getArrayInt32 | bslx.cpp:238:480:238:484 | getArrayUint32 output argument |
+| bslx.cpp:238:479:238:490 | *call to getArrayUint32 | bslx.cpp:238:504:238:515 | *call to getArrayInt40 |
+| bslx.cpp:238:479:238:490 | *call to getArrayUint32 | bslx.cpp:238:505:238:509 | getArrayInt40 output argument |
+| bslx.cpp:238:504:238:515 | *call to getArrayInt40 | bslx.cpp:238:530:238:542 | *call to getArrayUint40 |
+| bslx.cpp:238:504:238:515 | *call to getArrayInt40 | bslx.cpp:238:531:238:536 | getArrayUint40 output argument |
+| bslx.cpp:238:530:238:542 | *call to getArrayUint40 | bslx.cpp:238:556:238:567 | *call to getArrayInt48 |
+| bslx.cpp:238:530:238:542 | *call to getArrayUint40 | bslx.cpp:238:557:238:561 | getArrayInt48 output argument |
+| bslx.cpp:238:556:238:567 | *call to getArrayInt48 | bslx.cpp:238:582:238:594 | *call to getArrayUint48 |
+| bslx.cpp:238:556:238:567 | *call to getArrayInt48 | bslx.cpp:238:583:238:588 | getArrayUint48 output argument |
+| bslx.cpp:238:582:238:594 | *call to getArrayUint48 | bslx.cpp:238:608:238:619 | *call to getArrayInt56 |
+| bslx.cpp:238:582:238:594 | *call to getArrayUint48 | bslx.cpp:238:609:238:613 | getArrayInt56 output argument |
+| bslx.cpp:238:608:238:619 | *call to getArrayInt56 | bslx.cpp:238:634:238:646 | *call to getArrayUint56 |
+| bslx.cpp:238:608:238:619 | *call to getArrayInt56 | bslx.cpp:238:635:238:640 | getArrayUint56 output argument |
+| bslx.cpp:238:634:238:646 | *call to getArrayUint56 | bslx.cpp:238:660:238:671 | *call to getArrayInt64 |
+| bslx.cpp:238:634:238:646 | *call to getArrayUint56 | bslx.cpp:238:661:238:665 | getArrayInt64 output argument |
+| bslx.cpp:238:660:238:671 | *call to getArrayInt64 | bslx.cpp:238:686:238:698 | *call to getArrayUint64 |
+| bslx.cpp:238:660:238:671 | *call to getArrayInt64 | bslx.cpp:238:687:238:692 | getArrayUint64 output argument |
+| bslx.cpp:238:686:238:698 | *call to getArrayUint64 | bslx.cpp:238:714:238:724 | *call to getArrayFloat32 |
+| bslx.cpp:238:686:238:698 | *call to getArrayUint64 | bslx.cpp:238:715:238:718 | getArrayFloat32 output argument |
+| bslx.cpp:238:714:238:724 | *call to getArrayFloat32 | bslx.cpp:238:740:238:750 | *call to getArrayFloat64 |
+| bslx.cpp:238:714:238:724 | *call to getArrayFloat32 | bslx.cpp:238:741:238:744 | getArrayFloat64 output argument |
+| bslx.cpp:263:2:263:7 | *stream | bslx.cpp:263:18:263:21 | *call to getLength |
+| bslx.cpp:263:18:263:21 | *call to getLength | bslx.cpp:263:32:263:35 | *call to getVersion |
+| bslx.cpp:263:32:263:35 | *call to getVersion | bslx.cpp:263:43:263:46 | *call to getInt8 |
+| bslx.cpp:263:43:263:46 | *call to getInt8 | bslx.cpp:263:55:263:59 | *call to getUint8 |
+| bslx.cpp:263:55:263:59 | *call to getUint8 | bslx.cpp:263:68:263:71 | *call to getInt16 |
+| bslx.cpp:263:68:263:71 | *call to getInt16 | bslx.cpp:263:81:263:85 | *call to getUint16 |
+| bslx.cpp:263:81:263:85 | *call to getUint16 | bslx.cpp:263:94:263:97 | *call to getInt24 |
+| bslx.cpp:263:94:263:97 | *call to getInt24 | bslx.cpp:263:107:263:111 | *call to getUint24 |
+| bslx.cpp:263:107:263:111 | *call to getUint24 | bslx.cpp:263:120:263:123 | *call to getInt32 |
+| bslx.cpp:263:120:263:123 | *call to getInt32 | bslx.cpp:263:133:263:137 | *call to getUint32 |
+| bslx.cpp:263:133:263:137 | *call to getUint32 | bslx.cpp:263:146:263:150 | *call to getInt40 |
+| bslx.cpp:263:146:263:150 | *call to getInt40 | bslx.cpp:263:160:263:165 | *call to getUint40 |
+| bslx.cpp:263:160:263:165 | *call to getUint40 | bslx.cpp:263:174:263:178 | *call to getInt48 |
+| bslx.cpp:263:174:263:178 | *call to getInt48 | bslx.cpp:263:188:263:193 | *call to getUint48 |
+| bslx.cpp:263:188:263:193 | *call to getUint48 | bslx.cpp:263:202:263:206 | *call to getInt56 |
+| bslx.cpp:263:202:263:206 | *call to getInt56 | bslx.cpp:263:216:263:221 | *call to getUint56 |
+| bslx.cpp:263:216:263:221 | *call to getUint56 | bslx.cpp:263:230:263:234 | *call to getInt64 |
+| bslx.cpp:263:230:263:234 | *call to getInt64 | bslx.cpp:263:244:263:249 | *call to getUint64 |
+| bslx.cpp:263:244:263:249 | *call to getUint64 | bslx.cpp:263:260:263:263 | *call to getFloat32 |
+| bslx.cpp:263:260:263:263 | *call to getFloat32 | bslx.cpp:263:274:263:277 | *call to getFloat64 |
+| bslx.cpp:263:274:263:277 | *call to getFloat64 | bslx.cpp:263:287:263:292 | *call to getString |
+| bslx.cpp:263:274:263:277 | *call to getFloat64 | bslx.cpp:263:288:263:290 | getString output argument |
+| bslx.cpp:263:287:263:292 | *call to getString | bslx.cpp:263:305:263:315 | *call to getArrayInt8 |
+| bslx.cpp:263:287:263:292 | *call to getString | bslx.cpp:263:306:263:309 | getArrayInt8 output argument |
+| bslx.cpp:263:305:263:315 | *call to getArrayInt8 | bslx.cpp:263:329:263:340 | *call to getArrayUint8 |
+| bslx.cpp:263:305:263:315 | *call to getArrayInt8 | bslx.cpp:263:330:263:334 | getArrayUint8 output argument |
+| bslx.cpp:263:329:263:340 | *call to getArrayUint8 | bslx.cpp:263:354:263:364 | *call to getArrayInt16 |
+| bslx.cpp:263:329:263:340 | *call to getArrayUint8 | bslx.cpp:263:355:263:358 | getArrayInt16 output argument |
+| bslx.cpp:263:354:263:364 | *call to getArrayInt16 | bslx.cpp:263:379:263:390 | *call to getArrayUint16 |
+| bslx.cpp:263:354:263:364 | *call to getArrayInt16 | bslx.cpp:263:380:263:384 | getArrayUint16 output argument |
+| bslx.cpp:263:379:263:390 | *call to getArrayUint16 | bslx.cpp:263:404:263:414 | *call to getArrayInt24 |
+| bslx.cpp:263:379:263:390 | *call to getArrayUint16 | bslx.cpp:263:405:263:408 | getArrayInt24 output argument |
+| bslx.cpp:263:404:263:414 | *call to getArrayInt24 | bslx.cpp:263:429:263:440 | *call to getArrayUint24 |
+| bslx.cpp:263:404:263:414 | *call to getArrayInt24 | bslx.cpp:263:430:263:434 | getArrayUint24 output argument |
+| bslx.cpp:263:429:263:440 | *call to getArrayUint24 | bslx.cpp:263:454:263:464 | *call to getArrayInt32 |
+| bslx.cpp:263:429:263:440 | *call to getArrayUint24 | bslx.cpp:263:455:263:458 | getArrayInt32 output argument |
+| bslx.cpp:263:454:263:464 | *call to getArrayInt32 | bslx.cpp:263:479:263:490 | *call to getArrayUint32 |
+| bslx.cpp:263:454:263:464 | *call to getArrayInt32 | bslx.cpp:263:480:263:484 | getArrayUint32 output argument |
+| bslx.cpp:263:479:263:490 | *call to getArrayUint32 | bslx.cpp:263:504:263:515 | *call to getArrayInt40 |
+| bslx.cpp:263:479:263:490 | *call to getArrayUint32 | bslx.cpp:263:505:263:509 | getArrayInt40 output argument |
+| bslx.cpp:263:504:263:515 | *call to getArrayInt40 | bslx.cpp:263:530:263:542 | *call to getArrayUint40 |
+| bslx.cpp:263:504:263:515 | *call to getArrayInt40 | bslx.cpp:263:531:263:536 | getArrayUint40 output argument |
+| bslx.cpp:263:530:263:542 | *call to getArrayUint40 | bslx.cpp:263:556:263:567 | *call to getArrayInt48 |
+| bslx.cpp:263:530:263:542 | *call to getArrayUint40 | bslx.cpp:263:557:263:561 | getArrayInt48 output argument |
+| bslx.cpp:263:556:263:567 | *call to getArrayInt48 | bslx.cpp:263:582:263:594 | *call to getArrayUint48 |
+| bslx.cpp:263:556:263:567 | *call to getArrayInt48 | bslx.cpp:263:583:263:588 | getArrayUint48 output argument |
+| bslx.cpp:263:582:263:594 | *call to getArrayUint48 | bslx.cpp:263:608:263:619 | *call to getArrayInt56 |
+| bslx.cpp:263:582:263:594 | *call to getArrayUint48 | bslx.cpp:263:609:263:613 | getArrayInt56 output argument |
+| bslx.cpp:263:608:263:619 | *call to getArrayInt56 | bslx.cpp:263:634:263:646 | *call to getArrayUint56 |
+| bslx.cpp:263:608:263:619 | *call to getArrayInt56 | bslx.cpp:263:635:263:640 | getArrayUint56 output argument |
+| bslx.cpp:263:634:263:646 | *call to getArrayUint56 | bslx.cpp:263:660:263:671 | *call to getArrayInt64 |
+| bslx.cpp:263:634:263:646 | *call to getArrayUint56 | bslx.cpp:263:661:263:665 | getArrayInt64 output argument |
+| bslx.cpp:263:660:263:671 | *call to getArrayInt64 | bslx.cpp:263:686:263:698 | *call to getArrayUint64 |
+| bslx.cpp:263:660:263:671 | *call to getArrayInt64 | bslx.cpp:263:687:263:692 | getArrayUint64 output argument |
+| bslx.cpp:263:686:263:698 | *call to getArrayUint64 | bslx.cpp:263:714:263:724 | *call to getArrayFloat32 |
+| bslx.cpp:263:686:263:698 | *call to getArrayUint64 | bslx.cpp:263:715:263:718 | getArrayFloat32 output argument |
+| bslx.cpp:263:714:263:724 | *call to getArrayFloat32 | bslx.cpp:263:740:263:750 | *call to getArrayFloat64 |
+| bslx.cpp:263:714:263:724 | *call to getArrayFloat32 | bslx.cpp:263:741:263:744 | getArrayFloat64 output argument |
+| bslx.cpp:268:46:268:49 | *call to data | bslx.cpp:268:34:268:39 | call to ByteInStream |
+| bslx.cpp:270:53:270:58 | *stream | bslx.cpp:270:52:270:63 | *call to bdexStreamIn |
+| bslx.cpp:272:53:272:58 | *stream | bslx.cpp:272:52:272:66 | *call to bdexStreamIn |
+| bslx.cpp:275:52:275:66 | *call to bdexStreamIn | bslx.cpp:275:76:275:81 | *call to getString |
+| bslx.cpp:275:52:275:66 | *call to bdexStreamIn | bslx.cpp:275:77:275:79 | getString output argument |
+| bslx.cpp:275:53:275:58 | *stream | bslx.cpp:275:52:275:66 | *call to bdexStreamIn |
+| bslx.cpp:281:46:281:49 | *call to data | bslx.cpp:281:34:281:39 | call to ByteInStream |
+| bslx.cpp:283:53:283:58 | *stream | bslx.cpp:283:52:283:68 | *call to bdexStreamIn |
+| bslx.cpp:295:46:295:49 | *call to data | bslx.cpp:295:34:295:39 | call to ByteInStream |
+| bslx.cpp:297:53:297:58 | *stream | bslx.cpp:297:52:297:68 | *call to bdexStreamIn |
 | protobuf.cpp:118:22:118:25 | data | protobuf.cpp:118:2:118:4 | ParseFromString output argument |
 | protobuf.cpp:125:22:125:25 | *data | protobuf.cpp:125:2:125:4 | ParseFromString output argument |
 | protobuf.cpp:132:29:132:32 | data | protobuf.cpp:132:2:132:4 | ParsePartialFromString output argument |