* Werner et al. (2019) Mario Werner, Thomas Unterluggauer, Lukas Giner, Michael Schwarz, Daniel Gruss, and Stefan Mangard. 2019.  ScatterCache: Thwarting cache attacks via cache set randomization. In _USENIX Security Symposium_. USENIX Association, 675–692.
  * Wilander et al. (2011) John Wilander, Nick Nikiforakis, Yves Younan, Mariam Kamkar, and Wouter Joosen. 2011.  RIPE: Runtime intrusion prevention evaluator. In _Annual Computer Security Applications Conference_. ACM, 41–50.
  * Woodruff et al. (2014) Jonathan Woodruff, Robert N. M. Watson, David Chisnall, Simon W. Moore, Jonathan Anderson, Brooks Davis, Ben Laurie, Peter G. Neumann, Robert Norton, and Michael Roe. 2014\.  The CHERI capability model: Revisiting RISC in an age of risk. In _International Symposium on Computer Architecture_. 457–468.
  * Xie et al. (2016) Tianyi Xie, Yuanyuan Zhang, Juanru Li, Hui Liu, and Dawu Gu. 2016.  New exploit methods against Ptmalloc of GLIBC. In _IEEE International Conference on Trust, Security and Privacy in Computing and Communications_. IEEE, 646–653.
  * Xu (2021) Jinyan Xu. 2021\.  RISC-V Spike Simulator SDK.  https://github.com/phantom-v/riscv-rss-sdk.
  * Xu et al. (2019) Xiaoyang Xu, Masoud Ghaffarinia, Wenhao Wang, Kevin W. Hamlen, and Zhiqiang Lin. 2019\.  CONFIRM: Evaluating compatibility and relevance of control-flow integrity protections for modern software. In _USENIX Security Symposium_. USENIX Association, 1805–1821.
  * Yan et al. (2017) Mengjia Yan, Bhargava Gopireddy, Thomas Shull, and Josep Torrellas. 2017.  Secure hierarchy-aware cache replacement policy (SHARP): Defending against cache-based side channel atacks. In _Annual International Symposium on Computer Architecture_. ACM, 347–360.
  * Yarom and Falkner (2014) Yuval Yarom and Katrina Falkner. 2014.  FLUSH+RELOAD: A high resolution, low noise, L3 cache side-channel attack. In _USENIX Security Symposium_. USENIX Association, 719–732.
  * Younan (2015) Yves Younan. 2015\.  FreeSentry: Protecting against use-after-free vulnerabilities due to dangling pointers. In _Annual Network and Distributed System Security Symposium_. The Internet Society.
  * Zhang et al. (2018) Jun Zhang, Rui Hou, Wei Song, Zhiyuan Zhan, Boyan Zhao, Mingyu Chen, and Dan Meng. 2018.  Stateful forward-edge CFI enforcement with Intel MPX. In _Conference on Advanced Computer Architecture_. Springer Singapore, 79–94.
  * Zhivich et al. (2005) Mechael Zhivich, Tim Leek, and Richard Lippmann. 2005\.  Dynamic buffer overflow detection. In _Workshop on the Evaluation of Software Defect Detection Tools_ (Chicago, IL).
  * Zhu et al. (2018) Jianping Zhu, Wei Song, Ziyuan Zhu, Jiameng Ying, Boya Li, Bibo Tu, Gang Shi, Rui Hou, and Dan Meng. 2018\.  CPU security benchmark. In _Workshop on Security-Oriented Designs of Computer Architectures and Processors_. ACM, 8–14.

##  Appendix A Results for Different Architectures

$\surd$: test passes (no defense detected);
$\times$: test failed;
$\star$: exception raised;
$\otimes$: not tested due to failed prerequisites.

###  A.1. Spatial Safety

|  Intel i7-3770 |  Intel Xeon 8280 |  Jetson Nano |  Raspberry Pi 4B |  HiFive Unleashed |  Spike
---|---|---|---|---|---|---
overflow-read-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-read-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-read-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-read-index-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-read-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-read-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-read-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-read-ptr-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-read-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-read-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-read-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-read-index-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-read-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-read-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-read-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-read-ptr-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-write-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-write-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-write-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-write-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-write-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-write-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-write-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-write-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-write-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-write-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-write-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-write-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-object-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-object-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-object-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-object-index-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-object-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-object-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-object-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-object-ptr-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-write-cross-object-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-write-cross-object-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-write-cross-object-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-write-cross-object-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-write-cross-object-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
overflow-write-cross-object-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-write-cross-object-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-write-cross-object-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-write-cross-object-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-write-cross-object-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-write-cross-object-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
underflow-write-cross-object-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-frame-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-frame-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-frame-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-frame-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-page-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-page-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-page-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-page-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$

|  Intel i7-3770 |  Intel Xeon 8280 |  Jetson Nano |  Raspberry Pi 4B |  HiFive Unleashed |  Spike
---|---|---|---|---|---|---
read-cross-section-stack-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-stack-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-stack-to-rodata-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-heap-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-heap-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-heap-to-rodata-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-data-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-data-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-data-to-rodata-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-rodata-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-rodata-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-rodata-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-stack-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-stack-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-stack-to-rodata-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-heap-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-heap-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-heap-to-rodata-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-data-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-data-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-data-to-rodata-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-rodata-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-rodata-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-cross-section-rodata-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-section-stack-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-section-stack-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-section-heap-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-section-heap-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-section-data-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-section-data-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-section-stack-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-section-stack-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-section-heap-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-section-heap-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-section-data-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-cross-section-data-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
spray-cross-object-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
spray-cross-object-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
spray-cross-object-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
spray-cross-frame | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
spray-cross-page-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
spray-cross-page-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$

###  A.2. Temporal Safety

|  Intel i7-3770 |  Intel Xeon 8280 |  Jetson Nano |  Raspberry Pi 4B |  HiFive Unleashed |  Spike
---|---|---|---|---|---|---
read-after-free-org-heap | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\times$ | $\times$
read-after-free-alias-heap | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\times$ | $\times$
write-after-free-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
reallocate-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
access-after-reclaim-heap | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\times$ | $\times$
write-before-reclaim-heap | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\times$ | $\times$
write-after-reclaim-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-after-free-alias-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-after-free-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
reallocate-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
access-after-reclaim-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-before-reclaim-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-after-reclaim-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$

###  A.3. Access Control

|  Intel i7-3770 |  Intel Xeon 8280 |  Jetson Nano |  Raspberry Pi 4B |  HiFive Unleashed |  Spike
---|---|---|---|---|---|---
check-ASLR | $\surd$ | $\times$ | $\times$ | $\times$ | $\times$ | $\surd$
read-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-GOT | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$

###  A.4. Pointer Integrity

|  Intel i7-3770 |  Intel Xeon 8280 |  Jetson Nano |  Raspberry Pi 4B |  HiFive Unleashed |  Spike
---|---|---|---|---|---|---
func-pointer-assign | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
func-pointer-arithmetic | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-vtable-pointer | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-vtable-pointer | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
modify-GOT | $\surd$ | $\star$ | $\star$ | $\star$ | $\surd$ | $\surd$

###  A.5. Control-Flow Integrity

|  Intel i7-3770 |  Intel Xeon 8280 |  Jetson Nano |  Raspberry Pi 4B |  HiFive Unleashed |  Spike
---|---|---|---|---|---|---
return-to-instruction-in-stack | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$
return-to-instruction-in-heap | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$
return-to-instruction-in-data | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$
return-to-instruction-in-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\star$
return-to-wrong-call-site-within-static-analysis | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
return-to-wrong-call-site | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
return-to-non-call-site | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
return-to-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
return-to-libc | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
return-without-call | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-instruction-in-stack | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$
call-instruction-in-heap | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$
call-instruction-in-data | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$
call-instruction-in-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\star$
call-wrong-func-within-static-analysis | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-mid-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-num-arg-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-type-arg-int2double | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-type-arg-op2double | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-type-arg-op2intp | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-type-arg-fp2dp | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-type-arg-dp2fp-func-stack | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$
call-wrong-type-arg-dp2fp-func-heap | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$
call-wrong-type-arg-dp2fp-func-data | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$
call-wrong-type-arg-dp2fp-func-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$
call-wrong-func-vtable-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-func-vtable-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-func-vtable-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-func-vtable-parent | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-func-vtable-child | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-func-vtable-sibling | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-func-vtable | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-func-vtable-released | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$

|  Intel i7-3770 |  Intel Xeon 8280 |  Jetson Nano |  Raspberry Pi 4B |  HiFive Unleashed |  Spike
---|---|---|---|---|---|---
call-wrong-func-vtable-offset | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-num-arg-vtable | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
jump-instruction-in-stack | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$
jump-instruction-in-heap | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$
jump-instruction-in-data | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$
jump-instruction-in-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\star$
jump-mid-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$

##  Appendix B Results for Different Compiler Flags

###  B.1. GCC on Intel Xeon 8280

####  B.1.1. Summary

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
Spatial safety (98) | 98 | 98 | 98 | 98 | 98 | 0 | 98
Temporal safety (13) | 9 | 9 | 9 | 9 | 9 | 6 | 9
Access control (3) | 2 | 2 | 2 | 2 | 2 | 2 | 3
Pointer integrity (5) | 5 | 4 | 5 | 5 | 4 | 0 | 5
CFI (41) | 28 | 28 | 27 | 22 | 21 | 0 | 40
Total (160) | 142 | 141 | 141 | 136 | 134 | 8 | 155

####  B.1.2. Spatial Safety

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
overflow-read-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-index-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-ptr-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-index-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-ptr-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
read-cross-object-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-index-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-ptr-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-frame-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-frame-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-frame-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-frame-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-page-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-page-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-page-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-page-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-rodata-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-rodata-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-rodata-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-rodata-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-rodata-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-rodata-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-stack-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-stack-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-heap-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-heap-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-data-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-data-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-stack-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-stack-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-heap-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-heap-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-data-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-data-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-object-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-object-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-object-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-frame | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
spray-cross-page-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-page-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$

####  B.1.3. Temporal Safety

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
read-after-free-org-heap | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$
read-after-free-alias-heap | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$
write-after-free-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
reallocate-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
access-after-reclaim-heap | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\otimes$ | $\times$
write-before-reclaim-heap | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\otimes$ | $\times$
write-after-reclaim-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-after-free-alias-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-after-free-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
reallocate-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
access-after-reclaim-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-before-reclaim-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-after-reclaim-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$

####  B.1.4. Access Control

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
check-ASLR | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\surd$
read-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-GOT | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$

####  B.1.5. Pointer Integrity

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
func-pointer-assign | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
func-pointer-arithmetic | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-vtable-pointer | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
write-vtable-pointer | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
modify-GOT | $\surd$ | $\star$ | $\surd$ | $\surd$ | $\star$ | $\times$ | $\surd$

####  B.1.6. Control-Flow Integrity

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
return-to-instruction-in-stack | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\surd$
return-to-instruction-in-heap | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\surd$
return-to-instruction-in-data | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\surd$
return-to-instruction-in-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
return-to-wrong-call-site-within-static-analysis | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-wrong-call-site | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-non-call-site | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-libc | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-without-call | $\surd$ | $\surd$ | $\star$ | $\surd$ | $\star$ | $\otimes$ | $\surd$
call-instruction-in-stack | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\times$ | $\surd$
call-instruction-in-heap | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\times$ | $\surd$
call-instruction-in-data | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\times$ | $\surd$
call-instruction-in-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-func-within-static-analysis | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-mid-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-num-arg-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-type-arg-int2double | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-type-arg-op2double | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-type-arg-op2intp | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-type-arg-fp2dp | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-type-arg-dp2fp-func-stack | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\surd$
call-wrong-type-arg-dp2fp-func-heap | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\surd$
call-wrong-type-arg-dp2fp-func-data | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\surd$
call-wrong-type-arg-dp2fp-func-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable-stack | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\otimes$ | $\otimes$ | $\surd$
call-wrong-func-vtable-heap | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\otimes$ | $\otimes$ | $\surd$
call-wrong-func-vtable-data | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\otimes$ | $\otimes$ | $\surd$
call-wrong-func-vtable-parent | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable-child | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable-sibling | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable | $\surd$ | $\surd$ | $\surd$ | $\star$ | $\star$ | $\otimes$ | $\surd$
call-wrong-func-vtable-released | $\times$ | $\times$ | $\times$ | $\otimes$ | $\otimes$ | $\otimes$ | $\times$
call-wrong-func-vtable-offset | $\surd$ | $\surd$ | $\surd$ | $\star$ | $\star$ | $\otimes$ | $\surd$
call-wrong-num-arg-vtable | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\otimes$ | $\otimes$ | $\surd$
jump-instruction-in-stack | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\surd$
jump-instruction-in-heap | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\surd$
jump-instruction-in-data | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\surd$
jump-instruction-in-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
jump-mid-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$

###  B.2. GCC on Raspberry Pi 4B

####  B.2.1. Summary

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
Spatial safety (98) | 98 | 98 | 98 | 98 | 98 | 0 | 98
Temporal safety (13) | 9 | 9 | 9 | 9 | 9 | 6 | 9
Access control (3) | 2 | 2 | 2 | 2 | 2 | 2 | 3
Pointer integrity (5) | 5 | 4 | 5 | 5 | 4 | 0 | 5
CFI (41) | 28 | 28 | 26 | 22 | 20 | 0 | 32
Total (160) | 142 | 141 | 140 | 136 | 133 | 8 | 147

####  B.2.2. Spatial Safety

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
overflow-read-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-index-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-ptr-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-index-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-ptr-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
read-cross-object-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-index-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-ptr-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-frame-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-frame-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-frame-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-frame-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-page-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-page-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-page-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-page-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-rodata-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-rodata-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-rodata-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
read-cross-section-rodata-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-rodata-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-rodata-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-rodata-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-stack-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-stack-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-heap-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-heap-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-data-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-data-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-stack-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-stack-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-heap-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-heap-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-data-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-data-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-object-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-object-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-object-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-frame | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-page-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-page-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$

####  B.2.3. Temporal Safety

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
read-after-free-org-heap | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$
read-after-free-alias-heap | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$
write-after-free-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
reallocate-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
access-after-reclaim-heap | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\otimes$ | $\times$
write-before-reclaim-heap | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\otimes$ | $\times$
write-after-reclaim-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-after-free-alias-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-after-free-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
reallocate-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
access-after-reclaim-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-before-reclaim-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-after-reclaim-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$

####  B.2.4. Access Control

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
check-ASLR | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\surd$
read-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-GOT | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$

####  B.2.5. Pointer Integrity

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
func-pointer-assign | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
func-pointer-arithmetic | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-vtable-pointer | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
write-vtable-pointer | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
modify-GOT | $\surd$ | $\star$ | $\surd$ | $\surd$ | $\star$ | $\times$ | $\surd$

####  B.2.6. Control-Flow Integrity

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
return-to-instruction-in-stack | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\surd$
return-to-instruction-in-heap | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\star$
return-to-instruction-in-data | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\star$
return-to-instruction-in-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-wrong-call-site-within-static-analysis | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-wrong-call-site | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-non-call-site | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-libc | $\surd$ | $\surd$ | $\star$ | $\surd$ | $\star$ | $\otimes$ | $\surd$
return-without-call | $\surd$ | $\surd$ | $\star$ | $\surd$ | $\star$ | $\otimes$ | $\surd$
call-instruction-in-stack | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\times$ | $\surd$
call-instruction-in-heap | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\times$ | $\star$
call-instruction-in-data | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\times$ | $\star$
call-instruction-in-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-func-within-static-analysis | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-mid-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-num-arg-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-type-arg-int2double | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-type-arg-op2double | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-type-arg-op2intp | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-type-arg-fp2dp | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
call-wrong-type-arg-dp2fp-func-stack | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\surd$
call-wrong-type-arg-dp2fp-func-heap | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$
call-wrong-type-arg-dp2fp-func-data | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$
call-wrong-type-arg-dp2fp-func-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable-stack | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\otimes$ | $\otimes$ | $\surd$
call-wrong-func-vtable-heap | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\otimes$ | $\otimes$ | $\surd$
call-wrong-func-vtable-data | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\otimes$ | $\otimes$ | $\surd$
call-wrong-func-vtable-parent | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable-child | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable-sibling | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable | $\surd$ | $\surd$ | $\surd$ | $\star$ | $\star$ | $\otimes$ | $\surd$
call-wrong-func-vtable-released | $\times$ | $\times$ | $\times$ | $\otimes$ | $\otimes$ | $\otimes$ | $\times$
call-wrong-func-vtable-offset | $\surd$ | $\surd$ | $\surd$ | $\star$ | $\star$ | $\otimes$ | $\surd$
call-wrong-num-arg-vtable | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\otimes$ | $\otimes$ | $\surd$

|  Default |  RELRO |  Stack protection |  VTV |  All |  ASan |  None
---|---|---|---|---|---|---|---
jump-instruction-in-stack | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\surd$
jump-instruction-in-heap | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\star$
jump-instruction-in-data | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\star$
jump-instruction-in-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
jump-mid-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$

###  B.3. LLVM on Intel Xeon 8280

####  B.3.1. Summary

|  Default |  RELRO |  Stack protection |  CFI |  All |  ASan |  None
---|---|---|---|---|---|---|---
Spatial safety (98) | 98 | 98 | 98 | 98 | 98 | 0 | 98
Temporal safety (13) | 9 | 9 | 9 | 9 | 9 | 4 | 9
Access control (3) | 3 | 2 | 3 | 3 | 2 | 3 | 3
Pointer integrity (5) | 4 | 3 | 4 | 4 | 3 | 2 | 4
CFI (41) | 28 | 28 | 27 | 27 | 26 | 12 | 40
Total (160) | 142 | 140 | 141 | 141 | 138 | 21 | 154

####  B.3.2. Spatial Safety

|  Default |  RELRO |  Stack protection |  CFI |  All |  ASan |  None
---|---|---|---|---|---|---|---
overflow-read-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-index-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-read-ptr-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-index-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-read-ptr-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
overflow-write-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
underflow-write-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
read-cross-object-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-index-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-object-ptr-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$

|  Default |  RELRO |  Stack protection |  CFI |  All |  ASan |  None
---|---|---|---|---|---|---|---
overflow-write-cross-object-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
overflow-write-cross-object-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-index-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-index-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-index-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-ptr-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-ptr-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
underflow-write-cross-object-ptr-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-frame-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-frame-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-frame-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-frame-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-page-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-page-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-page-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-page-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-rodata-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-rodata-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-rodata-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-stack-to-rodata-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-heap-to-rodata-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-data-to-rodata-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-cross-section-rodata-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-stack-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-stack-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-heap-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-heap-to-data-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-data-to-stack-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-data-to-heap-index | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-stack-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-stack-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-heap-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-heap-to-data-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-data-to-stack-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-cross-section-data-to-heap-ptr | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-object-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-object-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-object-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-frame | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-page-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
spray-cross-page-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$

####  B.3.3. Temporal Safety

|  Default |  RELRO |  Stack protection |  CFI |  All |  ASan |  None
---|---|---|---|---|---|---|---
read-after-free-org-heap | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$
read-after-free-alias-heap | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$
write-after-free-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
reallocate-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
access-after-reclaim-heap | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\otimes$ | $\times$
write-before-reclaim-heap | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\otimes$ | $\times$
write-after-reclaim-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
read-after-free-alias-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-after-free-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
reallocate-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
access-after-reclaim-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
write-before-reclaim-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
write-after-reclaim-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$

####  B.3.4. Access Control

|  Default |  RELRO |  Stack protection |  CFI |  All |  ASan |  None
---|---|---|---|---|---|---|---
check-ASLR | $\surd$ | $\times$ | $\surd$ | $\surd$ | $\times$ | $\surd$ | $\surd$
read-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
read-GOT | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$

####  B.3.5. Pointer Integrity

|  Default |  RELRO |  Stack protection |  CFI |  All |  ASan |  None
---|---|---|---|---|---|---|---
func-pointer-assign | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
func-pointer-arithmetic | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\times$
read-vtable-pointer | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\times$ | $\surd$
write-vtable-pointer | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
modify-GOT | $\surd$ | $\star$ | $\surd$ | $\surd$ | $\star$ | $\surd$ | $\surd$

####  B.3.6. Control-Flow Integrity

|  Default |  RELRO |  Stack protection |  CFI |  All |  ASan |  None
---|---|---|---|---|---|---|---
return-to-instruction-in-stack | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\surd$
return-to-instruction-in-heap | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\surd$
return-to-instruction-in-data | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\otimes$ | $\surd$
return-to-instruction-in-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-wrong-call-site-within-static-analysis | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-wrong-call-site | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-non-call-site | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-to-libc | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
return-without-call | $\surd$ | $\surd$ | $\star$ | $\surd$ | $\star$ | $\otimes$ | $\surd$
call-instruction-in-stack | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\surd$
call-instruction-in-heap | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\surd$
call-instruction-in-data | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\surd$
call-instruction-in-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-func-within-static-analysis | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-mid-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-num-arg-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-type-arg-int2double | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-type-arg-op2double | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-type-arg-op2intp | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-type-arg-fp2dp | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
call-wrong-type-arg-dp2fp-func-stack | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\star$ | $\surd$
call-wrong-type-arg-dp2fp-func-heap | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\star$ | $\surd$
call-wrong-type-arg-dp2fp-func-data | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\otimes$ | $\star$ | $\surd$
call-wrong-type-arg-dp2fp-func-rodata | $\surd$ | $\surd$ | $\surd$ | $\star$ | $\star$ | $\surd$ | $\surd$
call-wrong-func-vtable-stack | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable-heap | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable-data | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable-parent | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable-child | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable-sibling | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-func-vtable-released | $\times$ | $\times$ | $\times$ | $\times$ | $\times$ | $\otimes$ | $\times$
call-wrong-func-vtable-offset | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
call-wrong-num-arg-vtable | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\otimes$ | $\surd$
jump-instruction-in-stack | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\surd$
jump-instruction-in-heap | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\surd$
jump-instruction-in-data | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\star$ | $\surd$
jump-instruction-in-rodata | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$
jump-mid-func | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$ | $\surd$