From what I understood, the trick is that, for a block which was returned by free() and later returned by calloc(), the former behavior was to zero within the c

From what I understood, the trick is that, for a block which was returned by free() and later returned by calloc(), the former behavior was to zero within the calloc(), while the new behavior would be to zero within the free(). If there's a bug which writes to the memory after the free() but before the calloc(), the former behavior would mean it's still zeroed, but the new behavior would mean it ends up overwritten with something which isn't all-zeros.