diff --git a/libc/Android.bp b/libc/Android.bp
index eee59d4..5f82b13 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -66,7 +66,6 @@
     cppflags: [],
     include_dirs: [
         "bionic/libc/async_safe/include",
-        "external/jemalloc_new/include",
     ],
 
     stl: "none",
@@ -86,6 +85,56 @@
     ldflags: ["-Wl,-z,muldefs"],
 }
 
+// Defaults for native allocator libs/includes to make it
+// easier to change.
+// To enable scudo, change the below to libc_scudo_defaults
+// and comment out the defaults line in libc_scudo shared
+// library.
+// ========================================================
+cc_defaults {
+    name: "libc_native_allocator_defaults",
+
+    defaults: ["libc_jemalloc5_defaults"],
+}
+
+cc_defaults {
+    name: "libc_jemalloc5_defaults",
+
+    include_dirs: [
+        "external/jemalloc_new/include",
+    ],
+
+    whole_static_libs: [
+        "libjemalloc5",
+        "libc_jemalloc_wrapper",
+    ],
+}
+
+// Functions not implemented by jemalloc directly, or that need to
+// be modified for Android.
+cc_library_static {
+    name: "libc_jemalloc_wrapper",
+    defaults: ["libc_defaults"],
+    srcs: ["bionic/jemalloc_wrapper.cpp"],
+    cflags: ["-fvisibility=hidden"],
+
+    include_dirs: [
+        "external/jemalloc_new/include",
+    ],
+}
+
+cc_defaults {
+    name: "libc_scudo_defaults",
+
+    cflags: [
+        "-DUSE_SCUDO",
+    ],
+
+    whole_static_libs: [
+        "libscudo",
+    ],
+}
+
 // ========================================================
 // libc_stack_protector.a - stack protector code
 // ========================================================
@@ -1199,7 +1248,7 @@
 // ========================================================
 // libc_pthread.a - pthreads parts that previously lived in
 // libc_bionic.a. Relocated to their own library because
-// they can't be included in libc_ndk.a (as they layout of
+// they can't be included in libc_ndk.a (as the layout of
 // pthread_t has changed over the years and has ABI
 // compatibility issues).
 // ========================================================
@@ -1332,7 +1381,10 @@
 
 cc_library_static {
     name: "libc_ndk",
-    defaults: ["libc_defaults"],
+    defaults: [
+        "libc_defaults",
+        "libc_native_allocator_defaults",
+    ],
     srcs: libc_common_src_files + [
         "bionic/malloc_common.cpp",
         "bionic/malloc_limit.cpp",
@@ -1365,7 +1417,6 @@
         "libc_freebsd",
         "libc_freebsd_large_stack",
         "libc_gdtoa",
-        "libc_malloc",
         "libc_netbsd",
         "libc_openbsd_large_stack",
         "libc_openbsd_ndk",
@@ -1373,7 +1424,6 @@
         "libc_syscalls",
         "libc_tzcode",
         "libm",
-        "libjemalloc5",
         "libstdc++",
     ],
 }
@@ -1399,7 +1449,6 @@
         "libc_freebsd",
         "libc_freebsd_large_stack",
         "libc_gdtoa",
-        "libc_malloc",
         "libc_netbsd",
         "libc_openbsd",
         "libc_openbsd_large_stack",
@@ -1506,17 +1555,6 @@
     ],
 }
 
-// ========================================================
-// libc_malloc.a: the _prefixed_ malloc functions (like dlcalloc).
-// ========================================================
-cc_library_static {
-    defaults: ["libc_defaults"],
-    srcs: ["bionic/jemalloc_wrapper.cpp"],
-    cflags: ["-fvisibility=hidden"],
-
-    name: "libc_malloc",
-}
-
 filegroup {
     name: "libc_sources_shared",
     srcs: [
@@ -1558,7 +1596,10 @@
 // libc.a + libc.so
 // ========================================================
 cc_library {
-    defaults: ["libc_defaults"],
+    defaults: [
+        "libc_defaults",
+        "libc_native_allocator_defaults",
+    ],
     name: "libc",
     static_ndk_lib: true,
     export_include_dirs: ["include"],
@@ -1606,9 +1647,6 @@
     static_libs: [
         "libdl_android",
     ],
-    whole_static_libs: [
-        "libjemalloc5",
-    ],
 
     nocrt: true,
 
@@ -1728,6 +1766,8 @@
     export_include_dirs: [
         "platform",
     ],
+    system_shared_libs: [],
+    stl: "none",
     sdk_version: "current",
 }
 
@@ -2475,9 +2515,8 @@
 
 // This is a temporary library that will use scudo as the native memory
 // allocator. To use it, add it as the first shared library.
-cc_library_shared {
-    name: "libc_scudo",
-    vendor_available: true,
+cc_defaults {
+    name: "libc_scudo_wrapper_defaults",
     srcs: [
         "bionic/malloc_common.cpp",
         "bionic/malloc_common_dynamic.cpp",
@@ -2487,16 +2526,12 @@
         "bionic/__set_errno.cpp",
     ],
     cflags: ["-DUSE_SCUDO"],
-    stl: "none",
-    system_shared_libs: [],
+    shared_libs: ["libscudo_wrapper"],
 
     header_libs: ["libc_headers"],
 
     static_libs: ["libasync_safe"],
 
-    allow_undefined_symbols: true,
-    shared_libs: ["libscudo_wrapper"],
-
     arch: {
         arm: {
             srcs: [":syscalls-arm.S"],
@@ -2518,7 +2553,16 @@
     // Mark this library as global so it overrides all the allocation
     // definitions properly.
     ldflags: ["-Wl,-z,global"],
+}
 
+cc_library_shared {
+    name: "libc_scudo",
+    defaults: ["libc_scudo_wrapper_defaults"],
+    vendor_available: true,
+    stl: "none",
+    system_shared_libs: [],
+
+    allow_undefined_symbols: true,
     // Like libc, disable native coverage for libc_scudo.
     native_coverage: false,
 }
diff --git a/libc/include/bits/fortify/poll.h b/libc/include/bits/fortify/poll.h
index 660dfca..7a727a4 100644
--- a/libc/include/bits/fortify/poll.h
+++ b/libc/include/bits/fortify/poll.h
@@ -35,8 +35,6 @@
 int __ppoll64_chk(struct pollfd*, nfds_t, const struct timespec*, const sigset64_t*, size_t) __INTRODUCED_IN(28);
 
 #if defined(__BIONIC_FORTIFY)
-#if __ANDROID_API__ >= __ANDROID_API_M__
-
 #define __bos_fd_count_trivially_safe(bos_val, fds, fd_count)              \
   __bos_dynamic_check_impl_and((bos_val), >=, (sizeof(*fds) * (fd_count)), \
                                (fd_count) <= __BIONIC_CAST(static_cast, nfds_t, -1) / sizeof(*fds))
@@ -46,26 +44,32 @@
     __overloadable
     __clang_error_if(__bos_unevaluated_lt(__bos(fds), sizeof(*fds) * fd_count),
                      "in call to 'poll', fd_count is larger than the given buffer") {
+#if __ANDROID_API__ >= __ANDROID_API_M__
   size_t bos_fds = __bos(fds);
 
-  if (__bos_fd_count_trivially_safe(bos_fds, fds, fd_count)) {
-    return __call_bypassing_fortify(poll)(fds, fd_count, timeout);
+  if (!__bos_fd_count_trivially_safe(bos_fds, fds, fd_count)) {
+    return __poll_chk(fds, fd_count, timeout, bos_fds);
   }
-  return __poll_chk(fds, fd_count, timeout, bos_fds);
+#endif /* __ANDROID_API__ >= __ANDROID_API_M__ */
+  return __call_bypassing_fortify(poll)(fds, fd_count, timeout);
 }
 
+#if __ANDROID_API__ >= __ANDROID_API_L__
 __BIONIC_FORTIFY_INLINE
 int ppoll(struct pollfd* const fds __pass_object_size, nfds_t fd_count, const struct timespec* timeout, const sigset_t* mask)
     __overloadable
     __clang_error_if(__bos_unevaluated_lt(__bos(fds), sizeof(*fds) * fd_count),
                      "in call to 'ppoll', fd_count is larger than the given buffer") {
+#if __ANDROID_API__ >= __ANDROID_API_M__
   size_t bos_fds = __bos(fds);
 
-  if (__bos_fd_count_trivially_safe(bos_fds, fds, fd_count)) {
-    return __call_bypassing_fortify(ppoll)(fds, fd_count, timeout, mask);
+  if (!__bos_fd_count_trivially_safe(bos_fds, fds, fd_count)) {
+    return __ppoll_chk(fds, fd_count, timeout, mask, bos_fds);
   }
-  return __ppoll_chk(fds, fd_count, timeout, mask, bos_fds);
+#endif /* __ANDROID_API__ >= __ANDROID_API_M__ */
+  return __call_bypassing_fortify(ppoll)(fds, fd_count, timeout, mask);
 }
+#endif /* __ANDROID_API__ >= __ANDROID_API_L__ */
 
 #if __ANDROID_API__ >= __ANDROID_API_P__
 __BIONIC_FORTIFY_INLINE
@@ -75,14 +79,13 @@
                      "in call to 'ppoll64', fd_count is larger than the given buffer") {
   size_t bos_fds = __bos(fds);
 
-  if (__bos_fd_count_trivially_safe(bos_fds, fds, fd_count)) {
-    return __call_bypassing_fortify(ppoll64)(fds, fd_count, timeout, mask);
+  if (!__bos_fd_count_trivially_safe(bos_fds, fds, fd_count)) {
+    return __ppoll64_chk(fds, fd_count, timeout, mask, bos_fds);
   }
-  return __ppoll64_chk(fds, fd_count, timeout, mask, bos_fds);
+  return __call_bypassing_fortify(ppoll64)(fds, fd_count, timeout, mask);
 }
-#endif
+#endif /* __ANDROID_API__ >= __ANDROID_API_P__ */
 
 #undef __bos_fd_count_trivially_safe
 
-#endif /* __ANDROID_API__ >= __ANDROID_API_M__ */
 #endif /* defined(__BIONIC_FORTIFY) */
diff --git a/libc/include/bits/fortify/stdio.h b/libc/include/bits/fortify/stdio.h
index 8bb5b68..528d5fb 100644
--- a/libc/include/bits/fortify/stdio.h
+++ b/libc/include/bits/fortify/stdio.h
@@ -50,7 +50,23 @@
 }
 #endif /* __ANDROID_API__ >= __ANDROID_API_J_MR1__ */
 
+__BIONIC_ERROR_FUNCTION_VISIBILITY
+int sprintf(char* dest, const char* format)
+    __overloadable
+    __enable_if(__bos_unevaluated_lt(__bos(dest), __builtin_strlen(format)),
+                "format string will always overflow destination buffer")
+    __errorattr("format string will always overflow destination buffer");
+
 #if __ANDROID_API__ >= __ANDROID_API_J_MR1__
+__BIONIC_FORTIFY_VARIADIC __printflike(2, 3)
+int sprintf(char* const __pass_object_size dest, const char* format, ...) __overloadable {
+    va_list va;
+    va_start(va, format);
+    int result = __builtin___vsprintf_chk(dest, 0, __bos(dest), format, va);
+    va_end(va);
+    return result;
+}
+
 /* No diag -- clang diagnoses misuses of this on its own.  */
 __BIONIC_FORTIFY_VARIADIC __printflike(3, 4)
 int snprintf(char* const __pass_object_size dest, size_t size, const char* format, ...)
@@ -61,26 +77,9 @@
     va_end(va);
     return result;
 }
-
-__BIONIC_ERROR_FUNCTION_VISIBILITY
-int sprintf(char* dest, const char* format)
-    __overloadable
-    __enable_if(__bos_unevaluated_lt(__bos(dest), __builtin_strlen(format)),
-                "format string will always overflow destination buffer")
-    __errorattr("format string will always overflow destination buffer");
-
-__BIONIC_FORTIFY_VARIADIC __printflike(2, 3)
-int sprintf(char* const __pass_object_size dest, const char* format, ...) __overloadable {
-    va_list va;
-    va_start(va, format);
-    int result = __builtin___vsprintf_chk(dest, 0, __bos(dest), format, va);
-    va_end(va);
-    return result;
-}
 #endif /* __ANDROID_API__ >= __ANDROID_API_J_MR1__ */
 
-#if __ANDROID_API__ >= __ANDROID_API_N__
-#define __bos_trivially_not_lt_mul(bos_val, size, count) \
+#define __bos_trivially_ge_mul(bos_val, size, count) \
   __bos_dynamic_check_impl_and(bos_val, >=, (size) * (count), \
                                !__unsafe_check_mul_overflow(size, count))
 
@@ -91,12 +90,14 @@
                          "in call to 'fread', size * count overflows")
         __clang_error_if(__bos_unevaluated_lt(__bos0(buf), size * count),
                          "in call to 'fread', size * count is too large for the given buffer") {
+#if __ANDROID_API__ >= __ANDROID_API_N__
     size_t bos = __bos0(buf);
 
-    if (__bos_trivially_not_lt_mul(bos, size, count)) {
-        return __call_bypassing_fortify(fread)(buf, size, count, stream);
+    if (!__bos_trivially_ge_mul(bos, size, count)) {
+        return __fread_chk(buf, size, count, stream, bos);
     }
-    return __fread_chk(buf, size, count, stream, bos);
+#endif /* __ANDROID_API__ >= __ANDROID_API_N__ */
+    return __call_bypassing_fortify(fread)(buf, size, count, stream);
 }
 
 __BIONIC_FORTIFY_INLINE
@@ -106,32 +107,31 @@
                          "in call to 'fwrite', size * count overflows")
         __clang_error_if(__bos_unevaluated_lt(__bos0(buf), size * count),
                          "in call to 'fwrite', size * count is too large for the given buffer") {
+#if __ANDROID_API__ >= __ANDROID_API_N__
     size_t bos = __bos0(buf);
 
-    if (__bos_trivially_not_lt_mul(bos, size, count)) {
-        return __call_bypassing_fortify(fwrite)(buf, size, count, stream);
+    if (!__bos_trivially_ge_mul(bos, size, count)) {
+        return __fwrite_chk(buf, size, count, stream, bos);
     }
-
-    return __fwrite_chk(buf, size, count, stream, bos);
-}
-#undef __bos_trivially_not_lt_mul
 #endif /* __ANDROID_API__ >= __ANDROID_API_N__ */
+    return __call_bypassing_fortify(fwrite)(buf, size, count, stream);
+}
+#undef __bos_trivially_ge_mul
 
-#if __ANDROID_API__ >= __ANDROID_API_J_MR1__
 __BIONIC_FORTIFY_INLINE
 char* fgets(char* const __pass_object_size dest, int size, FILE* stream)
         __overloadable
         __clang_error_if(size < 0, "in call to 'fgets', size should not be negative")
         __clang_error_if(__bos_unevaluated_lt(__bos(dest), size),
                          "in call to 'fgets', size is larger than the destination buffer") {
+#if __ANDROID_API__ >= __ANDROID_API_J_MR1__
     size_t bos = __bos(dest);
 
-    if (__bos_dynamic_check_impl_and(bos, >=, (size_t)size, size >= 0)) {
-        return __call_bypassing_fortify(fgets)(dest, size, stream);
+    if (!__bos_dynamic_check_impl_and(bos, >=, (size_t)size, size >= 0)) {
+        return __fgets_chk(dest, size, stream, bos);
     }
-
-    return __fgets_chk(dest, size, stream, bos);
-}
 #endif /* __ANDROID_API__ >= __ANDROID_API_J_MR1__ */
+    return __call_bypassing_fortify(fgets)(dest, size, stream);
+}
 
 #endif /* defined(__BIONIC_FORTIFY) */