diff --git a/tests/cfi_test.cpp b/tests/cfi_test.cpp
index 088dda6..5e2518f 100644
--- a/tests/cfi_test.cpp
+++ b/tests/cfi_test.cpp
@@ -22,6 +22,10 @@
 #include "gtest_globals.h"
 #include "utils.h"
 
+#if defined(__BIONIC__)
+#include "private/CFIShadow.h"
+#endif
+
 // Private libdl interface.
 extern "C" {
 void __cfi_slowpath(uint64_t CallSiteTypeId, void* Ptr);
@@ -40,15 +44,16 @@
   EXPECT_NE(0U, __cfi_shadow_size());
 
 #define SYM(type, name) auto name = reinterpret_cast<type>(dlsym(handle, #name))
-  SYM(int (*)(), get_count);
+  SYM(size_t (*)(), get_count);
   SYM(uint64_t(*)(), get_last_type_id);
   SYM(void* (*)(), get_last_address);
   SYM(void* (*)(), get_last_diag);
   SYM(void* (*)(), get_global_address);
   SYM(void (*)(uint64_t, void*, void*), __cfi_check);
+  SYM(char*, bss);
 #undef SYM
 
-  int c = get_count();
+  size_t c = get_count();
 
   // CFI check for code inside the DSO. Can't use just any function address - this is only
   // guaranteed to work for code addresses above __cfi_check.
@@ -88,6 +93,14 @@
   EXPECT_DEATH(__cfi_slowpath(46, p), "");
   free(p);
 
+  // Check all the addresses.
+  const size_t bss_size = 1024 * 1024;
+  static_assert(bss_size >= kLibraryAlignment * 2, "test range not big enough");
+  for (size_t i = 0; i < bss_size; ++i) {
+    __cfi_slowpath(47, bss + i);
+    EXPECT_EQ(++c, get_count());
+  }
+
   // Load the same library again.
   void* handle2 = dlopen("libcfi-test.so", RTLD_NOW | RTLD_LOCAL);
   ASSERT_TRUE(handle2 != nullptr) << dlerror();
diff --git a/tests/libs/cfi_test_lib.cpp b/tests/libs/cfi_test_lib.cpp
index 959b102..9f456d3 100644
--- a/tests/libs/cfi_test_lib.cpp
+++ b/tests/libs/cfi_test_lib.cpp
@@ -22,13 +22,16 @@
 // present. But it is only used in the bionic loader tests.
 extern "C" __attribute__((weak)) void __cfi_slowpath(uint64_t, void*);
 
-static int g_count;
+static size_t g_count;
 static uint64_t g_last_type_id;
 static void* g_last_address;
 static void* g_last_diag;
 
 extern "C" {
 
+// Make sure the library crosses at least one kLibraryAlignment(=256KB) boundary.
+char bss[1024 * 1024];
+
 // Mock a CFI-enabled library without relying on the compiler.
 __attribute__((aligned(4096))) void __cfi_check(uint64_t CallSiteTypeId, void* TargetAddr,
                                                 void* Diag) {
@@ -38,7 +41,7 @@
   g_last_diag = Diag;
 }
 
-int get_count() {
+size_t get_count() {
   return g_count;
 }