Thanks for the reply! I wasn't sure if you'd see mine, since it was two days late :) So I suppose the "use after free" protection is "best effort": it will try

Thanks for the reply! I wasn't sure if you'd see mine, since it was two days late :) So I suppose the "use after free" protection is "best effort": it will try to trap such use by unmapping the page, but there's no guarantee that it will definitely be the case. I suppose that's ok, since use after free is a bug anyway. We want to catch the bugs and protect against data corruption, but the programmer is still on the hook for not making the bugs in the first place, so if the protection does miss one, well, at least it tried -- its just an extra layer. It would certainly be wasteful if allocating a few bytes uses up an entire page, just so it can be unmapped when the memory is freed.