Can somebody explain to me how anybody could verify or reproduce working address randomization and position independent executables? This is basically what mus

Can somebody explain to me how anybody could verify or reproduce working address randomization and position independent executables? This is basically what muslc does, but with the kernel itself offering a memset / malloc with randomized padding, right? Also, what does ASLR brute force detection (SEGVGUARD) do? To me this sounds like malloc has a hook that maps process ids and tries to find heuristics of the allocated offsets? Anybody know where those features are documented do someone can try to bypass/exploit it?