diff --git a/cfg/posix.cfg b/cfg/posix.cfg
index 41b5999eb..d572cc06f 100644
--- a/cfg/posix.cfg
+++ b/cfg/posix.cfg
@@ -2025,7 +2025,8 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-bool/>
     </arg>
   </function>
-  <!-- int     dbm_clearerr(DBM *); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/dbm_clearerr.html -->
+  <!-- int dbm_clearerr(DBM *db); -->
   <function name="dbm_clearerr">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
@@ -2035,7 +2036,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-bool/>
     </arg>
   </function>
-  <!-- void    dbm_close(DBM *); -->
+  <!-- void dbm_close(DBM *db); -->
   <function name="dbm_close">
     <noreturn>false</noreturn>
     <arg nr="1">
@@ -2043,7 +2044,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-uninit/>
     </arg>
   </function>
-  <!-- int     dbm_delete(DBM *, datum); -->
+  <!-- int dbm_delete(DBM *db, datum key); -->
   <function name="dbm_delete">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
@@ -2051,11 +2052,11 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
   </function>
-  <!-- int     dbm_error(DBM *); -->
+  <!-- int dbm_error(DBM *db); -->
   <function name="dbm_error">
     <use-retval/>
     <returnValue type="int"/>
@@ -2066,7 +2067,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-bool/>
     </arg>
   </function>
-  <!-- datum   dbm_fetch(DBM *, datum); -->
+  <!-- datum dbm_fetch(DBM *db, datum key); -->
   <function name="dbm_fetch">
     <use-retval/>
     <returnValue type="datum"/>
@@ -2075,11 +2076,11 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
   </function>
-  <!-- datum   dbm_firstkey(DBM *); -->
+  <!-- datum dbm_firstkey(DBM *db); -->
   <function name="dbm_firstkey">
     <use-retval/>
     <returnValue type="datum"/>
@@ -2090,7 +2091,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-bool/>
     </arg>
   </function>
-  <!-- datum   dbm_nextkey(DBM *); -->
+  <!-- datum dbm_nextkey(DBM *db); -->
   <function name="dbm_nextkey">
     <use-retval/>
     <returnValue type="datum"/>
@@ -2101,23 +2102,23 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-bool/>
     </arg>
   </function>
-  <!-- DBM    *dbm_open(const char *, int, mode_t); -->
+  <!-- DBM *dbm_open(const char *file, int open_flags, mode_t file_mode); -->
   <function name="dbm_open">
     <returnValue type="DBM *"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
-  <!-- int     dbm_store(DBM *, datum, datum, int); -->
+  <!-- int dbm_store(DBM *db, datum key, datum content, int store_mode); -->
   <function name="dbm_store">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
@@ -2125,13 +2126,13 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -2151,28 +2152,29 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
   <function name="getaddrinfo">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="4">
-      <not-uninit/>
+    <arg nr="4" direction="out">
       <not-bool/>
     </arg>
   </function>
   <!-- void endhostent(void); -->
   <function name="endhostent">
     <noreturn>false</noreturn>
+    <returnValue type="void"/>
   </function>
   <!-- void sethostent(int stayopen); -->
   <function name="sethostent">
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <returnValue type="void"/>
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
   </function>
@@ -2202,7 +2204,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <use-retval/>
     <returnValue type="struct passwd *"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
@@ -2214,6 +2216,7 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     threadsafe function exists that should be used. -->
     <warn severity="portability">Non reentrant function 'strtok' called. For threadsafe applications it is recommended to use the reentrant replacement function 'strtok_r'.</warn>
   </function>
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/strtok.html -->
   <!-- char *strtok_r(char *str, const char *delim, char **saveptr); -->
   <function name="strtok_r">
     <!-- strtok may modify the first argument, so using the return value is not mandatory -->
@@ -2221,31 +2224,36 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <returnValue type="char *"/>
     <pure/>
     <leak-ignore/>
-    <arg nr="1">
+    <arg nr="1" direction="inout">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="inout">
       <not-null/>
       <not-bool/>
     </arg>
   </function>
-  <!--int getpwnam_r(const char *, struct passwd *, char *, size_t, struct passwd **); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/getpwnam.html -->
+  <!-- int getpwnam_r(const char *name, struct passwd *pwd, char *buffer, size_t bufsize, struct passwd **result); -->
   <function name="getpwnam_r">
     <use-retval/>
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="4">
+    <arg nr="2" direction="out"/>
+    <arg nr="3" direction="out">
+      <minsize type="argvalue" arg="4"/>
+    </arg>
+    <arg nr="4" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
-    <arg nr="5">
+    <arg nr="5" direction="out">
       <not-bool/>
     </arg>
   </function>
@@ -2254,32 +2262,39 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <use-retval/>
     <returnValue type="struct passwd *"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
     <warn severity="portability">Non reentrant function 'getpwuid' called. For threadsafe applications it is recommended to use the reentrant replacement function 'getpwuid_r'.</warn>
   </function>
-  <!-- int getpwuid_r(uid_t, struct passwd *, char *, size_t, struct passwd **); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/getpwuid.html -->
+  <!-- int getpwuid_r(uid_t uid, struct passwd *pwd, char *buffer, size_t bufsize, struct passwd **result); -->
   <function name="getpwuid_r">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="4">
+    <arg nr="2" direction="out"/>
+    <arg nr="3" direction="out">
+      <minsize type="argvalue" arg="4"/>
+    </arg>
+    <arg nr="4" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
-    <arg nr="5">
+    <arg nr="5" direction="out">
       <not-bool/>
     </arg>
   </function>
   <!-- void setpwent(void); -->
   <function name="setpwent">
     <noreturn>false</noreturn>
+    <returnValue type="void"/>
   </function>
-  <!-- int catclose(nl_catd); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/catclose.html -->
+  <!-- int catclose(nl_catd catd); -->
   <function name="catclose">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
@@ -2288,7 +2303,8 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
       <not-bool/>
     </arg>
   </function>
-  <!-- char *catgets(nl_catd, int, int, const char *); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/catgets.html -->
+  <!-- char *catgets(nl_catd catd, int set_id, int msg_id, const char *s); -->
   <function name="catgets">
     <returnValue type="char *"/>
     <use-retval/>
@@ -2296,102 +2312,106 @@ The function 'mktemp' is considered to be dangerous due to race conditions and s
     <arg nr="1">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="4">
+    <arg nr="4" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
-  <!-- nl_catd catopen(const char *, int); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/catopen.html -->
+  <!-- nl_catd catopen(const char *name, int oflag); -->
   <function name="catopen">
     <returnValue type="nl_catd"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
   <!-- http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/poll.h.html -->
-  <!-- int   poll(struct pollfd [], nfds_t, int); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/poll.html -->
+  <!-- int poll(struct pollfd fds[], nfds_t nfds, int timeout); -->
   <function name="poll">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="inout">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
-  <!-- int regcomp(regex_t *, const char *, int); -->
+  <!-- https://pubs.opengroup.org/onlinepubs/9699919799/functions/regcomp.html -->
+  <!-- int regcomp(regex_t *restrict preg, const char *restrict pattern, int cflags); -->
   <function name="regcomp">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="out">
       <not-null/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
-  <!-- size_t regerror(int, const regex_t *, char *, size_t); -->
+  <!-- size_t regerror(int errcode, const regex_t *restrict preg, char *restrict errbuf, size_t errbuf_size); -->
   <function name="regerror">
     <returnValue type="size_t"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-uninit/>
     </arg>
-    <arg nr="4">
+    <arg nr="3" direction="out">
+      <minsize type="argvalue" arg="4"/>
+    </arg>
+    <arg nr="4" direction="in">
       <not-uninit/>
       <valid>0:</valid>
       <not-bool/>
     </arg>
   </function>
-  <!-- int    regexec(const regex_t *, const char *, size_t, regmatch_t [restrict], int); -->
+  <!-- int regexec(const regex_t *restrict preg, const char *restrict string, size_t nmatch, regmatch_t pmatch[restrict], int eflags); -->
   <function name="regexec">
     <returnValue type="int"/>
     <noreturn>false</noreturn>
-    <arg nr="1">
+    <arg nr="1" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="2">
+    <arg nr="2" direction="in">
       <not-null/>
       <not-uninit/>
     </arg>
-    <arg nr="3">
+    <arg nr="3" direction="in">
       <not-uninit/>
       <valid>0:</valid>
     </arg>
-    <arg nr="4">
-      <not-uninit/>
-    </arg>
-    <arg nr="5">
+    <arg nr="4" direction="out"/>
+    <arg nr="5" direction="in">
       <not-uninit/>
       <not-bool/>
     </arg>
   </function>
-  <!-- void   regfree(regex_t *); -->
+  <!-- void regfree(regex_t *preg); -->
   <function name="regfree">
     <noreturn>false</noreturn>
     <arg nr="1">