That's not dynamic, it's still using BOS, _builtin_object_size, the classic FORTIFY compile-time check. A dynamic check would look at the first field in malloc

That's not dynamic, it's still using BOS, _builtin_object_size, the classic FORTIFY compile-time check. A dynamic check would look at the first field in malloced regions to get the dynamic size.