diff --git a/tests/cfi_test.cpp b/tests/cfi_test.cpp
index 088dda6..5e2518f 100644
--- a/tests/cfi_test.cpp
+++ b/tests/cfi_test.cpp
@@ -22,6 +22,10 @@
 #include "gtest_globals.h"
 #include "utils.h"
 
+#if defined(__BIONIC__)
+#include "private/CFIShadow.h"
+#endif
+
 // Private libdl interface.
 extern "C" {
 void __cfi_slowpath(uint64_t CallSiteTypeId, void* Ptr);
@@ -40,15 +44,16 @@
   EXPECT_NE(0U, __cfi_shadow_size());
 
 #define SYM(type, name) auto name = reinterpret_cast<type>(dlsym(handle, #name))
-  SYM(int (*)(), get_count);
+  SYM(size_t (*)(), get_count);
   SYM(uint64_t(*)(), get_last_type_id);
   SYM(void* (*)(), get_last_address);
   SYM(void* (*)(), get_last_diag);
   SYM(void* (*)(), get_global_address);
   SYM(void (*)(uint64_t, void*, void*), __cfi_check);
+  SYM(char*, bss);
 #undef SYM
 
-  int c = get_count();
+  size_t c = get_count();
 
   // CFI check for code inside the DSO. Can't use just any function address - this is only
   // guaranteed to work for code addresses above __cfi_check.
@@ -88,6 +93,14 @@
   EXPECT_DEATH(__cfi_slowpath(46, p), "");
   free(p);
 
+  // Check all the addresses.
+  const size_t bss_size = 1024 * 1024;
+  static_assert(bss_size >= kLibraryAlignment * 2, "test range not big enough");
+  for (size_t i = 0; i < bss_size; ++i) {
+    __cfi_slowpath(47, bss + i);
+    EXPECT_EQ(++c, get_count());
+  }
+
   // Load the same library again.
   void* handle2 = dlopen("libcfi-test.so", RTLD_NOW | RTLD_LOCAL);
   ASSERT_TRUE(handle2 != nullptr) << dlerror();