https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101476
--- Comment #4 from Stas Sergeev <stsp at users dot sourceforge.net> --- Thread 3 "X ev" hit Breakpoint 4, __sanitizer::UnsetAlternateSignalStack () at ../../../../libsanitizer/sanitizer_common/sanitizer_posix_libcdep.cpp:190 190 void UnsetAlternateSignalStack() { (gdb) n 194 altstack.ss_size = GetAltStackSize(); // Some sane value required on Darwin. (gdb) p /x $rsp $128 = 0x7fffee0a0ce0 (gdb) p &oldstack $129 = (stack_t *) 0x7fffee0a0d00 (gdb) p /x *(int *)0x7fffee0a0cc0 <== canary address $130 = 0x41b58ab3 (gdb) p 0x7fffee0a0ce0-0x7fffee0a0cc0 $132 = 32 Here we can see that before a call to GetAltStackSize(), rsp is 32 bytes above the lowest canary value. After the call, there is no more canary because 32 bytes are quickly overwritten by a call to getconf().