If you want to go further, ASAN and Valgrind both have APIs for integrating custom allocators. So you basically do what ASAN does with malloc in the first place

If you want to go further, ASAN and Valgrind both have APIs for integrating custom allocators. So you basically do what ASAN does with malloc in the first place—allocate (a bit more) memory, poison it, then pad all user allocations on both ends and only unpoison the actually requested part.