cfbolz, Anyone now what the least bad option is to express popcount of a bitvector in Z3 is? @regehr maybe? (I tried both a naive loop as well as a bit-twiddling advanced solution. the latter worked but was on the slow side, and the loop blows up all my timeouts)