diff --git a/libc/private/WriteProtected.h b/libc/private/WriteProtected.h
index 69a6822..d240e14 100644
--- a/libc/private/WriteProtected.h
+++ b/libc/private/WriteProtected.h
@@ -46,6 +46,16 @@
 
   WriteProtectedContents<T> contents;
 
+  int set_protection(int prot) {
+    auto addr = reinterpret_cast<uintptr_t>(&contents);
+#if __has_feature(hwaddress_sanitizer)
+    // The mprotect system call does not currently untag pointers, so do it
+    // ourselves.
+    addr &= (1ULL << 56) - 1;
+#endif
+    return mprotect(reinterpret_cast<void*>(addr), PAGE_SIZE, prot);
+  }
+
  public:
   WriteProtected() = default;
   BIONIC_DISALLOW_COPY_AND_ASSIGN(WriteProtected);
@@ -55,7 +65,7 @@
     // multiple times by accident.
     memset(&contents, 0, sizeof(contents));
 
-    if (mprotect(&contents, PAGE_SIZE, PROT_READ)) {
+    if (set_protection(PROT_READ)) {
       async_safe_fatal("failed to make WriteProtected nonwritable in initialize");
     }
   }
@@ -70,12 +80,12 @@
 
   template <typename Mutator>
   void mutate(Mutator mutator) {
-    if (mprotect(&contents, PAGE_SIZE, PROT_READ | PROT_WRITE) != 0) {
+    if (set_protection(PROT_READ | PROT_WRITE) != 0) {
       async_safe_fatal("failed to make WriteProtected writable in mutate: %s",
                        strerror(errno));
     }
     mutator(&contents.value);
-    if (mprotect(&contents, PAGE_SIZE, PROT_READ) != 0) {
+    if (set_protection(PROT_READ) != 0) {
       async_safe_fatal("failed to make WriteProtected nonwritable in mutate: %s",
                        strerror(errno));
     }
diff --git a/libdl/libdl_cfi.cpp b/libdl/libdl_cfi.cpp
index 1dd5b21..1446143 100644
--- a/libdl/libdl_cfi.cpp
+++ b/libdl/libdl_cfi.cpp
@@ -45,6 +45,10 @@
 
 static uint16_t shadow_load(void* p) {
   uintptr_t addr = reinterpret_cast<uintptr_t>(p);
+#ifdef __aarch64__
+  // Untag the pointer to move it into the address space covered by the shadow.
+  addr &= (1ULL << 56) - 1;
+#endif
   uintptr_t ofs = CFIShadow::MemToShadowOffset(addr);
   if (ofs > CFIShadow::kShadowSize) return CFIShadow::kInvalidShadow;
   return *reinterpret_cast<uint16_t*>(shadow_base_storage.v + ofs);