I worked on a 68K emulator that supported heap tagging, so you could: - detect multiple frees of the same memory, even when pointers had been returned by subse

I worked on a 68K emulator that supported heap tagging, so you could: - detect multiple frees of the same memory, even when pointers had been returned by subsequent allocation calls (e.g., alloc => A, free(A), alloc => A', free(A) would trap, where A and A' have the same program-observable values) - trap reads and writes to free'd memory, even if the memory had been subsequently re-allocated - do strong bounds checking (can't read or write heap block B with an offset of a pointer to A, even if you computed a valid address in B) - trap reads of uninitialized memory (you did mean to zero that buffer you allocated, right?), clear down to "that read of 32 bits included 8 bits that weren't initialized, did you mean that?" It wasn't perfect (you could do pointer arithmetic and smuggling operations that foiled the tagging), but we found some nice bugs with it. You can approach this with MMU games, but tagging all your values is more powerful.