LFG, exactly what I wanted

The only major omission in here is that it doesn't cover write-after-free check performed at allocation time for slab allocations when MTE is unavailable. MTE can be dynamically enabled which is why canaries aren't yet fully gone with it yet, but we do plan to fully drop them with MTE.

Since hardened_malloc has no inline metadata, our canary feature exists to avoid slab allocations being placed right next to each other. Their main purpose is providing 8 bytes of padding to absorb small overflows with a leading zero byte to stop most C string related overflows.

Scudo has inline metadata with 16-bit checksums of the metadata, address and a global secret. Those exist to provide probabilistic protection of inline metadata. Our canaries only use a random value to detect linear overflow at free, which is often way too late. MTE works better.

This is a great writeup, Thanks!