docs: def _categorize_successor(self, state):
          """
          Append state into successor lists.
  
          :param state: a SimState instance
          :param target: The target (of the jump/call/ret)
          :return: The state
          """
  
          self.all_successors.append(state)
          target = state.scratch.target
  
          # categorize the state
          if o.APPROXIMATE_GUARDS in state.options and state.solver.is_false(state.scratch.guard, exact=False):
              if o.VALIDATE_APPROXIMATIONS in state.options:
                  if state.satisfiable():
                      raise Exception('WTF')
              self.unsat_successors.append(state)
          elif o.APPROXIMATE_SATISFIABILITY in state.options and not state.solver.satisfiable(exact=False):
              if o.VALIDATE_APPROXIMATIONS in state.options:
                  if state.solver.satisfiable():
                      raise Exception('WTF')
              self.unsat_successors.append(state)
          elif not state.scratch.guard.symbolic and state.solver.is_false(state.scratch.guard):
              self.unsat_successors.append(state)
          elif o.LAZY_SOLVES not in state.options and not state.satisfiable():
              self.unsat_successors.append(state)
          elif o.NO_SYMBOLIC_JUMP_RESOLUTION in state.options and state.solver.symbolic(target):
              self.unconstrained_successors.append(state)
          elif not state.solver.symbolic(target) and not state.history.jumpkind.startswith("Ijk_Sys"):
              # a successor with a concrete IP, and it's not a syscall
              self.successors.append(state)
              self.flat_successors.append(state)
          elif state.history.jumpkind.startswith("Ijk_Sys"):
              # syscall
              self.successors.append(state)
  
              # Misuse the ip_at_syscall register to save the return address for this syscall
              # state.ip *might be* changed to be the real address of syscall SimProcedures by syscall handling code in
              # angr
              state.regs.ip_at_syscall = state.ip
  
              try:
                  symbolic_syscall_num, concrete_syscall_nums = self._resolve_syscall(state)
                  if concrete_syscall_nums is not None:
                      for i, n in enumerate(concrete_syscall_nums):
                          split_state = state if i == len(concrete_syscall_nums) - 1 else state.copy()
                          split_state.add_constraints(symbolic_syscall_num == n)
                          if split_state.supports_inspect:
                              split_state.inspect.downsize()
                          self._fix_syscall_ip(split_state)
  
                          self.flat_successors.append(split_state)
                  else:
                      # We cannot resolve the syscall number
                      # However, we still put it to the flat_successors list, and angr.SimOS.handle_syscall will pick it
                      # up, and create a "unknown syscall" stub for it.
                      self._fix_syscall_ip(state)
                      self.flat_successors.append(state)
              except AngrUnsupportedSyscallError:
                  self.unsat_successors.append(state)
  
          else:
              # a successor with a symbolic IP
              _max_targets = state.options.symbolic_ip_max_targets
              _max_jumptable_targets = state.options.jumptable_symbolic_ip_max_targets
              try:
                  if o.NO_IP_CONCRETIZATION in state.options:
                      # Don't try to concretize the IP
                      cond_and_targets = [ (claripy.true, target) ]
                      max_targets = 0
                  elif o.KEEP_IP_SYMBOLIC in state.options:
                      s = claripy.Solver()
                      addrs = s.eval(target, _max_targets + 1, extra_constraints=tuple(state.ip_constraints))
                      if len(addrs) > _max_targets:
                          # It is not a library
                          l.debug("It is not a Library")
                          addrs = state.solver.eval_upto(target, _max_targets + 1)
                          l.debug("addrs :%s", addrs)
                      cond_and_targets = [ (target == addr, addr) for addr in addrs ]
                      max_targets = _max_targets
                  else:
                      cond_and_targets = self._eval_target_jumptable(state, target, _max_jumptable_targets + 1)
                      if cond_and_targets is None:
                          # Fallback to the traditional and slow method
                          cond_and_targets = self._eval_target_brutal(state, target, _max_targets + 1)
                          max_targets = _max_targets
                      else:
                          max_targets = _max_jumptable_targets
  
                  if len(cond_and_targets) > max_targets:
                      l.warning(
                          "Exit state has over %d possible solutions. Likely unconstrained; skipping. %s",
                          max_targets,
                          target.shallow_repr()
                      )
                      self.unconstrained_successors.append(state)
                  else:
                      for cond, a in cond_and_targets:
                          split_state = state.copy()
                          if o.KEEP_IP_SYMBOLIC in split_state.options:
                              split_state.regs.ip = target
                          else:
                              split_state.add_constraints(cond, action=True)
                              split_state.regs.ip = a
                          if split_state.supports_inspect:
                              split_state.inspect.downsize()
                          self.flat_successors.append(split_state)
                      self.successors.append(state)
              except SimSolverModeError:
                  self.unsat_successors.append(state)
  
          return state