The capabilityness of a reference to a global, tls, or stack object should be decided by the LHS

[brooksdavis]

This should work in hybrid mode:

int foo;
int * __capability bar;
bar = &foo;

The required information is there to do this without a (__cheri_tocap int * __capability) cast and this is a very common pattern in a hybrid kernel.