Zaslat SMS: A formal CHERI-C memory model