Statistics for Reasoning About Foreign Function Interfaces: Blame and Nondeterministic Formal Semantics