Writing Coverity model: pointer in struct ALWAYS points to tainted data

Question

I reguarly check lwIP, a free TCP/IP stack with Coverity.

As a network stack, we have untrusted data coming in from the network which is stored in struct pbuf (some members omitted for clarity):

struct pbuf {
  void *payload;
  u16_t len;
  u16_t ref;
};

My questions are:

1) I want to model that "void* payload" of struct pbuf ALWAYS points to tainted data, every access to it must be untrusted. How can I do this?

2) We use refcounting (u16_t ref). Is there any way to model refcounting in Coverity?