diff --git a/README.md b/README.md
index e731e5f..0ad06a8 100644
--- a/README.md
+++ b/README.md
@@ -336,7 +336,9 @@
 
 ## Running the tests
 
-The tests are all built from the tests/ directory.
+The tests are all built from the tests/ directory. There is a separate
+directory `benchmarks/` containing benchmarks, and that has its own
+documentation on [running the benchmarks](benchmarks/README.md).
 
 ### Device tests
 
diff --git a/TEST_MAPPING b/TEST_MAPPING
index f56e16a..60a4f61 100644
--- a/TEST_MAPPING
+++ b/TEST_MAPPING
@@ -10,6 +10,9 @@
       "name": "linker-unit-tests"
     },
     {
+      "name": "CtsBionicAppTestCases"
+    },
+    {
       "name": "CtsBionicTestCases"
     },
     {
@@ -54,6 +57,9 @@
       "name": "linker-unit-tests"
     },
     {
+      "name": "CtsBionicAppTestCases"
+    },
+    {
       "name": "CtsBionicTestCases"
     },
     {
diff --git a/benchmarks/ctype_benchmark.cpp b/benchmarks/ctype_benchmark.cpp
index eab0133..c6c23b0 100644
--- a/benchmarks/ctype_benchmark.cpp
+++ b/benchmarks/ctype_benchmark.cpp
@@ -19,65 +19,78 @@
 #include <benchmark/benchmark.h>
 #include "util.h"
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalnum_y1, isalnum('A'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalnum_y2, isalnum('a'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalnum_y3, isalnum('0'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalnum_n, isalnum('_'));
+// Avoid optimization.
+volatile int A = 'A';
+volatile int a = 'a';
+volatile int X = 'X';
+volatile int x = 'x';
+volatile int backspace = '\b';
+volatile int del = '\x7f';
+volatile int space = ' ';
+volatile int tab = '\t';
+volatile int zero = '0';
+volatile int underscore = '_';
+volatile int top_bit_set = 0x88;
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalpha_y1, isalpha('A'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalpha_y2, isalpha('a'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalpha_n, isalpha('_'));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalnum_y1, isalnum(A));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalnum_y2, isalnum(a));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalnum_y3, isalnum(zero));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalnum_n, isalnum(underscore));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isascii_y, isascii('x'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isascii_n, isascii(0x88));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalpha_y1, isalpha(A));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalpha_y2, isalpha(a));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isalpha_n, isalpha(underscore));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isblank_y1, isblank(' '));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isblank_y2, isblank('\t'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isblank_n, isblank('_'));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isascii_y, isascii(x));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isascii_n, isascii(top_bit_set));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_iscntrl_y1, iscntrl('\b'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_iscntrl_y2, iscntrl('\x7f'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_iscntrl_n, iscntrl('_'));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isblank_y1, isblank(space));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isblank_y2, isblank(tab));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isblank_n, isblank(underscore));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isdigit_y, iscntrl('0'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isdigit_n, iscntrl('_'));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_iscntrl_y1, iscntrl(backspace));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_iscntrl_y2, iscntrl(del));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_iscntrl_n, iscntrl(underscore));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isgraph_y1, isgraph('A'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isgraph_y2, isgraph('a'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isgraph_y3, isgraph('0'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isgraph_y4, isgraph('_'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isgraph_n, isgraph(' '));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isdigit_y, iscntrl(zero));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isdigit_n, iscntrl(underscore));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_islower_y, islower('x'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_islower_n, islower('X'));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isgraph_y1, isgraph(A));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isgraph_y2, isgraph(a));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isgraph_y3, isgraph(zero));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isgraph_y4, isgraph(underscore));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isgraph_n, isgraph(space));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isprint_y1, isprint('A'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isprint_y2, isprint('a'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isprint_y3, isprint('0'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isprint_y4, isprint('_'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isprint_y5, isprint(' '));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isprint_n, isprint('\b'));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_islower_y, islower(x));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_islower_n, islower(X));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_ispunct_y, ispunct('_'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_ispunct_n, ispunct('A'));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isprint_y1, isprint(A));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isprint_y2, isprint(a));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isprint_y3, isprint(zero));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isprint_y4, isprint(underscore));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isprint_y5, isprint(space));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isprint_n, isprint(backspace));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isspace_y1, isspace(' '));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isspace_y2, isspace('\t'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isspace_n, isspace('A'));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_ispunct_y, ispunct(underscore));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_ispunct_n, ispunct(A));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isupper_y, isupper('X'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isupper_n, isupper('x'));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isspace_y1, isspace(space));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isspace_y2, isspace(tab));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isspace_n, isspace(A));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isxdigit_y1, isxdigit('0'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isxdigit_y2, isxdigit('a'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isxdigit_y3, isxdigit('A'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isxdigit_n, isxdigit('_'));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isupper_y, isupper(X));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isupper_n, isupper(x));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_toascii_y, isascii('x'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_toascii_n, isascii(0x88));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isxdigit_y1, isxdigit(zero));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isxdigit_y2, isxdigit(a));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isxdigit_y3, isxdigit(A));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_isxdigit_n, isxdigit(underscore));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_tolower_y, tolower('X'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_tolower_n, tolower('x'));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_toascii_y, isascii(x));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_toascii_n, isascii(top_bit_set));
 
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_toupper_y, toupper('x'));
-BIONIC_TRIVIAL_BENCHMARK(BM_ctype_toupper_n, toupper('X'));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_tolower_y, tolower(X));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_tolower_n, tolower(x));
+
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_toupper_y, toupper(x));
+BIONIC_TRIVIAL_BENCHMARK(BM_ctype_toupper_n, toupper(X));
diff --git a/libc/Android.bp b/libc/Android.bp
index 071f309..7098ab1 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -791,6 +791,7 @@
         "bionic/abort.cpp",
         "bionic/accept.cpp",
         "bionic/access.cpp",
+        "bionic/android_crash_detail.cpp",
         "bionic/android_set_abort_message.cpp",
         "bionic/android_unsafe_frame_pointer_chase.cpp",
         "bionic/arpa_inet.cpp",
@@ -819,8 +820,6 @@
         "bionic/dup.cpp",
         "bionic/environ.cpp",
         "bionic/error.cpp",
-        "bionic/ether_aton.c",
-        "bionic/ether_ntoa.c",
         "bionic/eventfd.cpp",
         "bionic/exec.cpp",
         "bionic/execinfo.cpp",
@@ -880,8 +879,9 @@
         "bionic/mknod.cpp",
         "bionic/mntent.cpp",
         "bionic/mremap.cpp",
-        "bionic/net_if.cpp",
         "bionic/netdb.cpp",
+        "bionic/net_if.cpp",
+        "bionic/netinet_ether.cpp",
         "bionic/netinet_in.cpp",
         "bionic/nl_types.cpp",
         "bionic/open.cpp",
diff --git a/libc/bionic/__bionic_get_shell_path.cpp b/libc/bionic/__bionic_get_shell_path.cpp
index b78aede..3ea256d 100644
--- a/libc/bionic/__bionic_get_shell_path.cpp
+++ b/libc/bionic/__bionic_get_shell_path.cpp
@@ -28,29 +28,15 @@
 
 #include "private/__bionic_get_shell_path.h"
 
-#include <errno.h>
-#include <string.h>
-#include <sys/cdefs.h>
-#include <unistd.h>
-
-#define VENDOR_PREFIX "/vendor/"
-
-static const char* init_sh_path() {
+const char* __bionic_get_shell_path() {
+  // For the host Bionic, we use the standard /bin/sh.
+  // Since P there's a /bin -> /system/bin symlink that means this will work
+  // for the device too, but as long as the NDK supports earlier API levels,
+  // we should probably make sure that this works in static binaries run on
+  // those OS versions too.
 #if !defined(__ANDROID__)
-  // For the host Bionic, use the standard /bin/sh
   return "/bin/sh";
 #else
-  // Look for /system or /vendor prefix.
-  char exe_path[strlen(VENDOR_PREFIX)];
-  ssize_t len = readlink("/proc/self/exe", exe_path, sizeof(exe_path));
-  if (len != -1 && !strncmp(exe_path, VENDOR_PREFIX, strlen(VENDOR_PREFIX))) {
-    return "/vendor/bin/sh";
-  }
   return "/system/bin/sh";
-#endif  // if !defined(__ANDROID__)
-}
-
-const char* __bionic_get_shell_path() {
-  static const char* sh_path = init_sh_path();
-  return sh_path;
+#endif
 }
diff --git a/libc/bionic/android_crash_detail.cpp b/libc/bionic/android_crash_detail.cpp
new file mode 100644
index 0000000..30ce505
--- /dev/null
+++ b/libc/bionic/android_crash_detail.cpp
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <android/crash_detail.h>
+
+#include <async_safe/log.h>
+#include <bionic/crash_detail_internal.h>
+
+#include <bits/stdatomic.h>
+#include <pthread.h>
+#include <stddef.h>
+#include <stdint.h>
+#include <string.h>
+#include <sys/mman.h>
+#include <sys/prctl.h>
+
+#include "private/ScopedPthreadMutexLocker.h"
+#include "private/bionic_defs.h"
+#include "private/bionic_globals.h"
+
+static _Atomic(crash_detail_t*) free_head = nullptr;
+
+__BIONIC_WEAK_FOR_NATIVE_BRIDGE
+crash_detail_t* android_crash_detail_register(const void* name, size_t name_size, const void* data,
+                                              size_t data_size) {
+  auto populate_crash_detail = [&](crash_detail_t* result) {
+    result->name = reinterpret_cast<const char*>(name);
+    result->name_size = name_size;
+    result->data = reinterpret_cast<const char*>(data);
+    result->data_size = data_size;
+  };
+  // This is a atomic fast-path for RAII use-cases where the app keeps creating and deleting
+  // crash details for short periods of time to capture detailed scopes.
+  if (crash_detail_t* head = atomic_load(&free_head)) {
+    while (head != nullptr && !atomic_compare_exchange_strong(&free_head, &head, head->prev_free)) {
+      // intentionally left blank.
+    }
+    if (head) {
+      head->prev_free = nullptr;
+      populate_crash_detail(head);
+      return head;
+    }
+  }
+  ScopedPthreadMutexLocker locker(&__libc_shared_globals()->crash_detail_page_lock);
+  struct crash_detail_page_t* prev = nullptr;
+  struct crash_detail_page_t* page = __libc_shared_globals()->crash_detail_page;
+  if (page != nullptr && page->used == kNumCrashDetails) {
+    prev = page;
+    page = nullptr;
+  }
+  if (page == nullptr) {
+    size_t size = sizeof(crash_detail_page_t);
+    void* map = mmap(nullptr, size, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0);
+    if (map == MAP_FAILED) {
+      async_safe_format_log(ANDROID_LOG_ERROR, "libc", "failed to allocate crash_detail_page: %m");
+      return nullptr;
+    }
+    prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, map, size, "crash details");
+    page = reinterpret_cast<struct crash_detail_page_t*>(map);
+    page->prev = prev;
+    __libc_shared_globals()->crash_detail_page = page;
+  }
+  crash_detail_t* result = &page->crash_details[page->used];
+  populate_crash_detail(result);
+  page->used++;
+  return result;
+}
+
+__BIONIC_WEAK_FOR_NATIVE_BRIDGE
+void android_crash_detail_unregister(crash_detail_t* crash_detail) {
+  if (crash_detail) {
+    if (crash_detail->prev_free) {
+      // removing already removed would mess up the free-list by creating a circle.
+      return;
+    }
+    crash_detail->data = nullptr;
+    crash_detail->name = nullptr;
+    crash_detail_t* prev = atomic_load(&free_head);
+    do {
+      crash_detail->prev_free = prev;
+    } while (!atomic_compare_exchange_strong(&free_head, &prev, crash_detail));
+  }
+}
+
+__BIONIC_WEAK_FOR_NATIVE_BRIDGE
+void android_crash_detail_replace_data(crash_detail_t* crash_detail, const void* data,
+                                       size_t data_size) {
+  crash_detail->data = reinterpret_cast<const char*>(data);
+  crash_detail->data_size = data_size;
+}
+
+__BIONIC_WEAK_FOR_NATIVE_BRIDGE
+void android_crash_detail_replace_name(crash_detail_t* crash_detail, const void* name,
+                                       size_t name_size) {
+  crash_detail->name = reinterpret_cast<const char*>(name);
+  crash_detail->name_size = name_size;
+}
diff --git a/libc/bionic/android_set_abort_message.cpp b/libc/bionic/android_set_abort_message.cpp
index 53d7576..05adf3e 100644
--- a/libc/bionic/android_set_abort_message.cpp
+++ b/libc/bionic/android_set_abort_message.cpp
@@ -29,7 +29,6 @@
 #include <android/set_abort_message.h>
 
 #include <async_safe/log.h>
-#include <bionic/set_abort_message_internal.h>
 
 #include <bits/stdatomic.h>
 #include <pthread.h>
@@ -60,8 +59,6 @@
               "The in-memory layout of magic_abort_msg_t is not consistent with what automated "
               "tools expect.");
 
-static _Atomic(crash_detail_t*) free_head = nullptr;
-
 [[clang::optnone]]
 static void fill_abort_message_magic(magic_abort_msg_t* new_magic_abort_message) {
   // 128-bit magic for the abort message. Chosen by fair dice roll.
@@ -103,65 +100,3 @@
   strcpy(new_magic_abort_message->msg.msg, msg);
   __libc_shared_globals()->abort_msg = &new_magic_abort_message->msg;
 }
-
-__BIONIC_WEAK_FOR_NATIVE_BRIDGE
-crash_detail_t* android_register_crash_detail(const void* name, size_t name_size, const void* data,
-                                              size_t data_size) {
-  auto populate_crash_detail = [&](crash_detail_t* result) {
-    result->name = reinterpret_cast<const char*>(name);
-    result->name_size = name_size;
-    result->data = reinterpret_cast<const char*>(data);
-    result->data_size = data_size;
-  };
-  // This is a atomic fast-path for RAII use-cases where the app keeps creating and deleting
-  // crash details for short periods of time to capture detailed scopes.
-  if (crash_detail_t* head = atomic_load(&free_head)) {
-    while (head != nullptr && !atomic_compare_exchange_strong(&free_head, &head, head->prev_free)) {
-      // intentionally left blank.
-    }
-    if (head) {
-      head->prev_free = nullptr;
-      populate_crash_detail(head);
-      return head;
-    }
-  }
-  ScopedPthreadMutexLocker locker(&__libc_shared_globals()->crash_detail_page_lock);
-  struct crash_detail_page_t* prev = nullptr;
-  struct crash_detail_page_t* page = __libc_shared_globals()->crash_detail_page;
-  if (page != nullptr && page->used == kNumCrashDetails) {
-    prev = page;
-    page = nullptr;
-  }
-  if (page == nullptr) {
-    size_t size = sizeof(crash_detail_page_t);
-    void* map = mmap(nullptr, size, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0);
-    if (map == MAP_FAILED) {
-      async_safe_format_log(ANDROID_LOG_ERROR, "libc", "failed to allocate crash_detail_page: %m");
-      return nullptr;
-    }
-    prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, map, size, "crash details");
-    page = reinterpret_cast<struct crash_detail_page_t*>(map);
-    page->prev = prev;
-    __libc_shared_globals()->crash_detail_page = page;
-  }
-  crash_detail_t* result = &page->crash_details[page->used];
-  populate_crash_detail(result);
-  page->used++;
-  return result;
-}
-
-__BIONIC_WEAK_FOR_NATIVE_BRIDGE
-void android_unregister_crash_detail(crash_detail_t* crash_detail) {
-  if (crash_detail) {
-    if (crash_detail->prev_free) {
-      // removing already removed would mess up the free-list by creating a circle.
-      return;
-    }
-    crash_detail->data = nullptr;
-    crash_detail->name = nullptr;
-    crash_detail_t* prev = atomic_load(&free_head);
-    do {
-      crash_detail->prev_free = prev;
-    } while (!atomic_compare_exchange_strong(&free_head, &prev, crash_detail));
-  }
-}
diff --git a/libc/bionic/ether_aton.c b/libc/bionic/ether_aton.c
deleted file mode 100644
index edd6b11..0000000
--- a/libc/bionic/ether_aton.c
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * Copyright (C) 2010 The Android Open Source Project
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
- * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
- * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <net/ethernet.h>
-
-#include <ctype.h>
-#include <stdio.h>
-#include <stdlib.h>
-
-static inline int
-xdigit (char c) {
-    unsigned d;
-    d = (unsigned)(c-'0');
-    if (d < 10) return (int)d;
-    d = (unsigned)(c-'a');
-    if (d < 6) return (int)(10+d);
-    d = (unsigned)(c-'A');
-    if (d < 6) return (int)(10+d);
-    return -1;
-}
-
-/*
- * Convert Ethernet address in the standard hex-digits-and-colons to binary
- * representation.
- * Re-entrant version (GNU extensions)
- */
-struct ether_addr *
-ether_aton_r (const char *asc, struct ether_addr * addr)
-{
-    int i, val0, val1;
-    for (i = 0; i < ETHER_ADDR_LEN; ++i) {
-        val0 = xdigit(*asc);
-        asc++;
-        if (val0 < 0)
-            return NULL;
-
-        val1 = xdigit(*asc);
-        asc++;
-        if (val1 < 0)
-            return NULL;
-
-        addr->ether_addr_octet[i] = (u_int8_t)((val0 << 4) + val1);
-
-        if (i < ETHER_ADDR_LEN - 1) {
-            if (*asc != ':')
-                return NULL;
-            asc++;
-        }
-    }
-    if (*asc != '\0')
-        return NULL;
-    return addr;
-}
-
-/*
- * Convert Ethernet address in the standard hex-digits-and-colons to binary
- * representation.
- */
-struct ether_addr *
-ether_aton (const char *asc)
-{
-    static struct ether_addr addr;
-    return ether_aton_r(asc, &addr);
-}
diff --git a/libc/bionic/ether_ntoa.c b/libc/bionic/ether_ntoa.c
deleted file mode 100644
index 7c31af3..0000000
--- a/libc/bionic/ether_ntoa.c
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Copyright (C) 2010 The Android Open Source Project
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *  * Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *  * Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
- * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
- * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
- * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
- * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <stdio.h>
-#include <sys/types.h>
-#include <net/ethernet.h>
-
-/*
- * Convert Ethernet address to standard hex-digits-and-colons printable form.
- * Re-entrant version (GNU extensions).
- */
-char *
-ether_ntoa_r (const struct ether_addr *addr, char * buf)
-{
-    snprintf(buf, 18, "%02x:%02x:%02x:%02x:%02x:%02x",
-            addr->ether_addr_octet[0], addr->ether_addr_octet[1],
-            addr->ether_addr_octet[2], addr->ether_addr_octet[3],
-            addr->ether_addr_octet[4], addr->ether_addr_octet[5]);
-    return buf;
-}
-
-/*
- * Convert Ethernet address to standard hex-digits-and-colons printable form.
- */
-char *
-ether_ntoa (const struct ether_addr *addr)
-{
-    static char buf[18];
-    return ether_ntoa_r(addr, buf);
-}
diff --git a/libc/bionic/fdsan.cpp b/libc/bionic/fdsan.cpp
index 84d2c94..0b0678b 100644
--- a/libc/bionic/fdsan.cpp
+++ b/libc/bionic/fdsan.cpp
@@ -219,6 +219,8 @@
       return "ZipArchive";
     case ANDROID_FDSAN_OWNER_TYPE_NATIVE_HANDLE:
       return "native_handle_t";
+    case ANDROID_FDSAN_OWNER_TYPE_PARCEL:
+      return "Parcel";
 
     case ANDROID_FDSAN_OWNER_TYPE_GENERIC_00:
     default:
diff --git a/libc/bionic/fork.cpp b/libc/bionic/fork.cpp
index d432c6d..615e81f 100644
--- a/libc/bionic/fork.cpp
+++ b/libc/bionic/fork.cpp
@@ -50,11 +50,13 @@
   return result;
 }
 
+int _Fork() {
+  return __clone_for_fork();
+}
+
 int fork() {
   __bionic_atfork_run_prepare();
-
-  int result = __clone_for_fork();
-
+  int result = _Fork();
   if (result == 0) {
     // Disable fdsan and fdtrack post-fork, so we don't falsely trigger on processes that
     // fork, close all of their fds, and then exec.
diff --git a/libc/bionic/heap_tagging.cpp b/libc/bionic/heap_tagging.cpp
index 48ec955..0c1e506 100644
--- a/libc/bionic/heap_tagging.cpp
+++ b/libc/bionic/heap_tagging.cpp
@@ -57,6 +57,7 @@
         break;
       case M_HEAP_TAGGING_LEVEL_SYNC:
       case M_HEAP_TAGGING_LEVEL_ASYNC:
+        atomic_store(&globals->memtag, true);
         atomic_store(&globals->memtag_stack, __libc_shared_globals()->initial_memtag_stack);
         break;
       default:
@@ -113,6 +114,7 @@
           globals->heap_pointer_tag = static_cast<uintptr_t>(0xffull << UNTAG_SHIFT);
         }
         atomic_store(&globals->memtag_stack, false);
+        atomic_store(&globals->memtag, false);
       });
 
       if (heap_tagging_level != M_HEAP_TAGGING_LEVEL_TBI) {
diff --git a/libc/bionic/libc_init_dynamic.cpp b/libc/bionic/libc_init_dynamic.cpp
index c61810e..1180a51 100644
--- a/libc/bionic/libc_init_dynamic.cpp
+++ b/libc/bionic/libc_init_dynamic.cpp
@@ -39,11 +39,12 @@
  *   all dynamic linking has been performed.
  */
 
+#include <elf.h>
 #include <stddef.h>
+#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <stdint.h>
-#include <elf.h>
+#include "bionic/pthread_internal.h"
 #include "libc_init_common.h"
 
 #include "private/bionic_defs.h"
@@ -59,6 +60,11 @@
   extern int __cxa_atexit(void (*)(void *), void *, void *);
 };
 
+void memtag_stack_dlopen_callback() {
+  async_safe_format_log(ANDROID_LOG_INFO, "libc", "remapping stacks as PROT_MTE");
+  __pthread_internal_remap_stack_with_mte();
+}
+
 // Use an initializer so __libc_sysinfo will have a fallback implementation
 // while .preinit_array constructors run.
 #if defined(__i386__)
@@ -156,6 +162,10 @@
 
   __libc_init_mte_late();
 
+  // This roundabout way is needed so we don't use the static libc linked into the linker, which
+  // will not affect the process.
+  __libc_shared_globals()->memtag_stack_dlopen_callback = memtag_stack_dlopen_callback;
+
   exit(slingshot(args.argc - __libc_shared_globals()->initial_linker_arg_count,
                  args.argv + __libc_shared_globals()->initial_linker_arg_count,
                  args.envp));
diff --git a/libc/bionic/libc_init_static.cpp b/libc/bionic/libc_init_static.cpp
index 00faa5b..f091ff8 100644
--- a/libc/bionic/libc_init_static.cpp
+++ b/libc/bionic/libc_init_static.cpp
@@ -305,6 +305,14 @@
   bool memtag_stack = false;
   HeapTaggingLevel level =
       __get_tagging_level(memtag_dynamic_entries, phdr_start, phdr_ct, load_bias, &memtag_stack);
+  // This is used by the linker (in linker.cpp) to communicate than any library linked by this
+  // executable enables memtag-stack.
+  if (__libc_shared_globals()->initial_memtag_stack) {
+    if (!memtag_stack) {
+      async_safe_format_log(ANDROID_LOG_INFO, "libc", "enabling PROT_MTE as requested by linker");
+    }
+    memtag_stack = true;
+  }
   char* env = getenv("BIONIC_MEMTAG_UPGRADE_SECS");
   static const char kAppProcessName[] = "app_process64";
   const char* progname = __libc_shared_globals()->init_progname;
@@ -373,6 +381,8 @@
   }
   // We did not enable MTE, so we do not need to arm the upgrade timer.
   __libc_shared_globals()->heap_tagging_upgrade_timer_sec = 0;
+  // We also didn't enable memtag_stack.
+  __libc_shared_globals()->initial_memtag_stack = false;
 }
 #else   // __aarch64__
 void __libc_init_mte(const memtag_dynamic_entries_t*, const void*, size_t, uintptr_t, void*) {}
diff --git a/libc/bionic/netinet_ether.cpp b/libc/bionic/netinet_ether.cpp
new file mode 100644
index 0000000..7ebceac
--- /dev/null
+++ b/libc/bionic/netinet_ether.cpp
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2010 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <netinet/ether.h>
+
+#include <stdio.h>
+
+ether_addr* ether_aton_r(const char* asc, ether_addr* addr) {
+  int bytes[ETHER_ADDR_LEN], end;
+  int n = sscanf(asc, "%x:%x:%x:%x:%x:%x%n",
+                 &bytes[0], &bytes[1], &bytes[2],
+                 &bytes[3], &bytes[4], &bytes[5], &end);
+  if (n != ETHER_ADDR_LEN || asc[end] != '\0') return NULL;
+  for (int i = 0; i < ETHER_ADDR_LEN; i++) {
+    if (bytes[i] > 0xff) return NULL;
+    addr->ether_addr_octet[i] = bytes[i];
+  }
+  return addr;
+}
+
+struct ether_addr* ether_aton(const char* asc) {
+  static ether_addr addr;
+  return ether_aton_r(asc, &addr);
+}
+
+char* ether_ntoa_r(const ether_addr* addr, char* buf) {
+  snprintf(buf, 18, "%02x:%02x:%02x:%02x:%02x:%02x",
+           addr->ether_addr_octet[0], addr->ether_addr_octet[1],
+           addr->ether_addr_octet[2], addr->ether_addr_octet[3],
+           addr->ether_addr_octet[4], addr->ether_addr_octet[5]);
+  return buf;
+}
+
+char* ether_ntoa(const ether_addr* addr) {
+  static char buf[18];
+  return ether_ntoa_r(addr, buf);
+}
diff --git a/libc/bionic/pathconf.cpp b/libc/bionic/pathconf.cpp
index 9724f44..9bbecc3 100644
--- a/libc/bionic/pathconf.cpp
+++ b/libc/bionic/pathconf.cpp
@@ -107,14 +107,6 @@
     case _PC_REC_MIN_XFER_SIZE:
       return s.f_bsize;
 
-#if 0
-    case _PC_REC_INCR_XFER_SIZE:
-    case _PC_REC_MAX_XFER_SIZE:
-#endif
-
-    case _PC_SYMLINK_MAX:
-      return -1; /* no limit */
-
     case _PC_CHOWN_RESTRICTED:
       return _POSIX_CHOWN_RESTRICTED;
 
@@ -125,12 +117,15 @@
       return _POSIX_VDISABLE;
 
     case _PC_ASYNC_IO:
-      return -1;
-
     case _PC_PRIO_IO:
-      return -1;
-
+    case _PC_REC_INCR_XFER_SIZE:
+    case _PC_REC_MAX_XFER_SIZE:
+    case _PC_SYMLINK_MAX:
     case _PC_SYNC_IO:
+      // No API to answer these: the caller will have to "try it and see".
+      // This differs from the next case in not setting errno to EINVAL,
+      // since we did understand the question --- we just don't have a
+      // good answer.
       return -1;
 
     default:
diff --git a/libc/bionic/pthread_attr.cpp b/libc/bionic/pthread_attr.cpp
index de4cc9e..f6c0401 100644
--- a/libc/bionic/pthread_attr.cpp
+++ b/libc/bionic/pthread_attr.cpp
@@ -155,36 +155,6 @@
   return 0;
 }
 
-static uintptr_t __get_main_stack_startstack() {
-  FILE* fp = fopen("/proc/self/stat", "re");
-  if (fp == nullptr) {
-    async_safe_fatal("couldn't open /proc/self/stat: %m");
-  }
-
-  char line[BUFSIZ];
-  if (fgets(line, sizeof(line), fp) == nullptr) {
-    async_safe_fatal("couldn't read /proc/self/stat: %m");
-  }
-
-  fclose(fp);
-
-  // See man 5 proc. There's no reason comm can't contain ' ' or ')',
-  // so we search backwards for the end of it. We're looking for this field:
-  //
-  //  startstack %lu (28) The address of the start (i.e., bottom) of the stack.
-  uintptr_t startstack = 0;
-  const char* end_of_comm = strrchr(line, ')');
-  if (sscanf(end_of_comm + 1, " %*c "
-             "%*d %*d %*d %*d %*d "
-             "%*u %*u %*u %*u %*u %*u %*u "
-             "%*d %*d %*d %*d %*d %*d "
-             "%*u %*u %*d %*u %*u %*u %" SCNuPTR, &startstack) != 1) {
-    async_safe_fatal("couldn't parse /proc/self/stat");
-  }
-
-  return startstack;
-}
-
 static int __pthread_attr_getstack_main_thread(void** stack_base, size_t* stack_size) {
   ErrnoRestorer errno_restorer;
 
@@ -198,28 +168,11 @@
   if (stack_limit.rlim_cur == RLIM_INFINITY) {
     stack_limit.rlim_cur = 8 * 1024 * 1024;
   }
-
-  // Ask the kernel where our main thread's stack started.
-  uintptr_t startstack = __get_main_stack_startstack();
-
-  // Hunt for the region that contains that address.
-  FILE* fp = fopen("/proc/self/maps", "re");
-  if (fp == nullptr) {
-    async_safe_fatal("couldn't open /proc/self/maps: %m");
-  }
-  char line[BUFSIZ];
-  while (fgets(line, sizeof(line), fp) != nullptr) {
-    uintptr_t lo, hi;
-    if (sscanf(line, "%" SCNxPTR "-%" SCNxPTR, &lo, &hi) == 2) {
-      if (lo <= startstack && startstack <= hi) {
-        *stack_size = stack_limit.rlim_cur;
-        *stack_base = reinterpret_cast<void*>(hi - *stack_size);
-        fclose(fp);
-        return 0;
-      }
-    }
-  }
-  async_safe_fatal("stack not found in /proc/self/maps");
+  uintptr_t lo, hi;
+  __find_main_stack_limits(&lo, &hi);
+  *stack_size = stack_limit.rlim_cur;
+  *stack_base = reinterpret_cast<void*>(hi - *stack_size);
+  return 0;
 }
 
 __BIONIC_WEAK_FOR_NATIVE_BRIDGE
diff --git a/libc/bionic/pthread_internal.cpp b/libc/bionic/pthread_internal.cpp
index 6a7ee2f..bfe2f98 100644
--- a/libc/bionic/pthread_internal.cpp
+++ b/libc/bionic/pthread_internal.cpp
@@ -40,6 +40,7 @@
 #include "private/ErrnoRestorer.h"
 #include "private/ScopedRWLock.h"
 #include "private/bionic_futex.h"
+#include "private/bionic_globals.h"
 #include "private/bionic_tls.h"
 
 static pthread_internal_t* g_thread_list = nullptr;
@@ -119,6 +120,89 @@
   return nullptr;
 }
 
+static uintptr_t __get_main_stack_startstack() {
+  FILE* fp = fopen("/proc/self/stat", "re");
+  if (fp == nullptr) {
+    async_safe_fatal("couldn't open /proc/self/stat: %m");
+  }
+
+  char line[BUFSIZ];
+  if (fgets(line, sizeof(line), fp) == nullptr) {
+    async_safe_fatal("couldn't read /proc/self/stat: %m");
+  }
+
+  fclose(fp);
+
+  // See man 5 proc. There's no reason comm can't contain ' ' or ')',
+  // so we search backwards for the end of it. We're looking for this field:
+  //
+  //  startstack %lu (28) The address of the start (i.e., bottom) of the stack.
+  uintptr_t startstack = 0;
+  const char* end_of_comm = strrchr(line, ')');
+  if (sscanf(end_of_comm + 1,
+             " %*c "
+             "%*d %*d %*d %*d %*d "
+             "%*u %*u %*u %*u %*u %*u %*u "
+             "%*d %*d %*d %*d %*d %*d "
+             "%*u %*u %*d %*u %*u %*u %" SCNuPTR,
+             &startstack) != 1) {
+    async_safe_fatal("couldn't parse /proc/self/stat");
+  }
+
+  return startstack;
+}
+
+void __find_main_stack_limits(uintptr_t* low, uintptr_t* high) {
+  // Ask the kernel where our main thread's stack started.
+  uintptr_t startstack = __get_main_stack_startstack();
+
+  // Hunt for the region that contains that address.
+  FILE* fp = fopen("/proc/self/maps", "re");
+  if (fp == nullptr) {
+    async_safe_fatal("couldn't open /proc/self/maps: %m");
+  }
+  char line[BUFSIZ];
+  while (fgets(line, sizeof(line), fp) != nullptr) {
+    uintptr_t lo, hi;
+    if (sscanf(line, "%" SCNxPTR "-%" SCNxPTR, &lo, &hi) == 2) {
+      if (lo <= startstack && startstack <= hi) {
+        *low = lo;
+        *high = hi;
+        fclose(fp);
+        return;
+      }
+    }
+  }
+  async_safe_fatal("stack not found in /proc/self/maps");
+}
+
+void __pthread_internal_remap_stack_with_mte() {
+#if defined(__aarch64__)
+  // If process doesn't have MTE enabled, we don't need to do anything.
+  if (!__libc_globals->memtag) return;
+  bool prev = true;
+  __libc_globals.mutate(
+      [&prev](libc_globals* globals) { prev = atomic_exchange(&globals->memtag_stack, true); });
+  if (prev) return;
+  uintptr_t lo, hi;
+  __find_main_stack_limits(&lo, &hi);
+
+  if (mprotect(reinterpret_cast<void*>(lo), hi - lo,
+               PROT_READ | PROT_WRITE | PROT_MTE | PROT_GROWSDOWN)) {
+    async_safe_fatal("error: failed to set PROT_MTE on main thread");
+  }
+  ScopedWriteLock creation_locker(&g_thread_creation_lock);
+  ScopedReadLock list_locker(&g_thread_list_lock);
+  for (pthread_internal_t* t = g_thread_list; t != nullptr; t = t->next) {
+    if (t->terminating || t->is_main()) continue;
+    if (mprotect(t->mmap_base_unguarded, t->mmap_size_unguarded,
+                 PROT_READ | PROT_WRITE | PROT_MTE)) {
+      async_safe_fatal("error: failed to set PROT_MTE on thread: %d", t->tid);
+    }
+  }
+#endif
+}
+
 bool android_run_on_all_threads(bool (*func)(void*), void* arg) {
   // Take the locks in this order to avoid inversion (pthread_create ->
   // __pthread_internal_add).
diff --git a/libc/bionic/pthread_internal.h b/libc/bionic/pthread_internal.h
index 3b9e6a4..091f711 100644
--- a/libc/bionic/pthread_internal.h
+++ b/libc/bionic/pthread_internal.h
@@ -178,6 +178,7 @@
   bionic_tls* bionic_tls;
 
   int errno_value;
+  bool is_main() { return start_routine == nullptr; }
 };
 
 struct ThreadMapping {
@@ -207,6 +208,7 @@
 __LIBC_HIDDEN__ pid_t __pthread_internal_gettid(pthread_t pthread_id, const char* caller);
 __LIBC_HIDDEN__ void __pthread_internal_remove(pthread_internal_t* thread);
 __LIBC_HIDDEN__ void __pthread_internal_remove_and_free(pthread_internal_t* thread);
+__LIBC_HIDDEN__ void __find_main_stack_limits(uintptr_t* low, uintptr_t* high);
 
 static inline __always_inline bionic_tcb* __get_bionic_tcb() {
   return reinterpret_cast<bionic_tcb*>(&__get_tls()[MIN_TLS_SLOT]);
@@ -266,6 +268,9 @@
 __LIBC_HIDDEN__ extern void __bionic_atfork_run_child();
 __LIBC_HIDDEN__ extern void __bionic_atfork_run_parent();
 
+// Re-map all threads and successively launched threads with PROT_MTE.
+__LIBC_HIDDEN__ void __pthread_internal_remap_stack_with_mte();
+
 extern "C" bool android_run_on_all_threads(bool (*func)(void*), void* arg);
 
 extern pthread_rwlock_t g_thread_creation_lock;
diff --git a/libc/bionic/sysconf.cpp b/libc/bionic/sysconf.cpp
index ff72b93..9ffb58e 100644
--- a/libc/bionic/sysconf.cpp
+++ b/libc/bionic/sysconf.cpp
@@ -41,16 +41,6 @@
 #include "platform/bionic/page.h"
 #include "private/bionic_tls.h"
 
-static long __sysconf_fread_long(const char* path) {
-  long result = 0;
-  FILE* fp = fopen(path, "re");
-  if (fp != nullptr) {
-    fscanf(fp, "%ld", &result);
-    fclose(fp);
-  }
-  return result;
-}
-
 struct sysconf_cache {
   long size, assoc, linesize;
 
@@ -100,6 +90,16 @@
 
 #else
 
+static long __sysconf_fread_long(const char* path) {
+  long result = 0;
+  FILE* fp = fopen(path, "re");
+  if (fp != nullptr) {
+    fscanf(fp, "%ld", &result);
+    fclose(fp);
+  }
+  return result;
+}
+
 static sysconf_caches* __sysconf_caches() {
   static sysconf_caches cached = []{
     sysconf_caches info = {};
@@ -182,8 +182,8 @@
 
     case _SC_AVPHYS_PAGES:      return get_avphys_pages();
     case _SC_CHILD_MAX:         return __sysconf_rlimit(RLIMIT_NPROC);
-    case _SC_CLK_TCK:           return static_cast<long>(getauxval(AT_CLKTCK));
-    case _SC_NGROUPS_MAX:       return __sysconf_fread_long("/proc/sys/kernel/ngroups_max");
+    case _SC_CLK_TCK:
+      return static_cast<long>(getauxval(AT_CLKTCK));
     case _SC_NPROCESSORS_CONF:  return get_nprocs_conf();
     case _SC_NPROCESSORS_ONLN:  return get_nprocs();
     case _SC_OPEN_MAX:          return __sysconf_rlimit(RLIMIT_NOFILE);
@@ -205,6 +205,11 @@
     case _SC_COLL_WEIGHTS_MAX:  return _POSIX2_COLL_WEIGHTS_MAX;  // Minimum requirement.
     case _SC_EXPR_NEST_MAX:     return _POSIX2_EXPR_NEST_MAX;     // Minimum requirement.
     case _SC_LINE_MAX:          return _POSIX2_LINE_MAX;          // Minimum requirement.
+    case _SC_NGROUPS_MAX:
+      // Only root can read /proc/sys/kernel/ngroups_max on Android, and groups
+      // are vestigial anyway, so the "maximum maximum" of NGROUPS_MAX is a good
+      // enough answer for _SC_NGROUPS_MAX...
+      return NGROUPS_MAX;
     case _SC_PASS_MAX:          return PASS_MAX;
     case _SC_2_C_BIND:          return _POSIX2_C_BIND;
     case _SC_2_C_DEV:           return _POSIX2_C_DEV;
diff --git a/libc/bionic/system_property_set.cpp b/libc/bionic/system_property_set.cpp
index f7999db..6e49bce 100644
--- a/libc/bionic/system_property_set.cpp
+++ b/libc/bionic/system_property_set.cpp
@@ -49,21 +49,34 @@
 #include "private/ScopedFd.h"
 
 static const char property_service_socket[] = "/dev/socket/" PROP_SERVICE_NAME;
+static const char property_service_for_system_socket[] =
+    "/dev/socket/" PROP_SERVICE_FOR_SYSTEM_NAME;
 static const char* kServiceVersionPropertyName = "ro.property_service.version";
 
 class PropertyServiceConnection {
  public:
-  PropertyServiceConnection() : last_error_(0) {
+  PropertyServiceConnection(const char* name) : last_error_(0) {
     socket_.reset(::socket(AF_LOCAL, SOCK_STREAM | SOCK_CLOEXEC, 0));
     if (socket_.get() == -1) {
       last_error_ = errno;
       return;
     }
 
-    const size_t namelen = strlen(property_service_socket);
+    // If we're trying to set "sys.powerctl" from a privileged process, use the special
+    // socket. Because this socket is only accessible to privileged processes, it can't
+    // be DoSed directly by malicious apps. (The shell user should be able to reboot,
+    // though, so we don't just always use the special socket for "sys.powerctl".)
+    // See b/262237198 for context
+    const char* socket = property_service_socket;
+    if (strcmp(name, "sys.powerctl") == 0 &&
+        access(property_service_for_system_socket, W_OK) == 0) {
+      socket = property_service_for_system_socket;
+    }
+
+    const size_t namelen = strlen(socket);
     sockaddr_un addr;
     memset(&addr, 0, sizeof(addr));
-    strlcpy(addr.sun_path, property_service_socket, sizeof(addr.sun_path));
+    strlcpy(addr.sun_path, socket, sizeof(addr.sun_path));
     addr.sun_family = AF_LOCAL;
     socklen_t alen = namelen + offsetof(sockaddr_un, sun_path) + 1;
 
@@ -176,7 +189,7 @@
 };
 
 static int send_prop_msg(const prop_msg* msg) {
-  PropertyServiceConnection connection;
+  PropertyServiceConnection connection(msg->name);
   if (!connection.IsValid()) {
     return connection.GetLastError();
   }
@@ -269,7 +282,7 @@
     // New protocol only allows long values for ro. properties only.
     if (strlen(value) >= PROP_VALUE_MAX && strncmp(key, "ro.", 3) != 0) return -1;
     // Use proper protocol
-    PropertyServiceConnection connection;
+    PropertyServiceConnection connection(key);
     if (!connection.IsValid()) {
       errno = connection.GetLastError();
       async_safe_format_log(ANDROID_LOG_WARN, "libc",
diff --git a/libc/include/android/crash_detail.h b/libc/include/android/crash_detail.h
new file mode 100644
index 0000000..1889f9f
--- /dev/null
+++ b/libc/include/android/crash_detail.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+/**
+ * @file android/crash_detail.h
+ * @brief Attach extra information to android crashes.
+ */
+
+#include <stddef.h>
+#include <sys/cdefs.h>
+
+__BEGIN_DECLS
+
+typedef struct crash_detail_t crash_detail_t;
+
+/**
+ * Register a new buffer to get logged into tombstones for crashes.
+ *
+ * It will be added to both the tombstone proto in the crash_detail field, and
+ * in the tombstone text format.
+ *
+ * Tombstone proto definition:
+ *   https://cs.android.com/android/platform/superproject/main/+/main:system/core/debuggerd/proto/tombstone.proto
+ *
+ * An app can get hold of these for any `REASON_CRASH_NATIVE` instance of
+ * `android.app.ApplicationExitInfo`.
+ *
+ * https://developer.android.com/reference/android/app/ApplicationExitInfo#getTraceInputStream()
+
+ * The lifetime of name and data has to be valid until the program crashes, or until
+ * android_crash_detail_unregister is called.
+ *
+ * Example usage:
+ *   const char* stageName = "garbage_collection";
+ *   crash_detail_t* cd = android_crash_detail_register("stage", stageName, strlen(stageName));
+ *   do_garbage_collection();
+ *   android_crash_detail_unregister(cd);
+ *
+ * If this example crashes in do_garbage_collection, a line will show up in the textual representation of the tombstone:
+ *   Extra crash detail: stage: 'garbage_collection'
+ *
+ * Introduced in API 35.
+ *
+ * \param name identifying name for this extra data.
+ *             this should generally be a human-readable debug string, but we are treating
+ *             it as arbitrary bytes because it could be corrupted by the crash.
+ * \param name_size number of bytes of the buffer pointed to by name
+ * \param data a buffer containing the extra detail bytes, if null the crash detail
+ *             is disabled until android_crash_detail_replace_data replaces it with
+ *             a non-null pointer.
+ * \param data_size number of bytes of the buffer pointed to by data
+ *
+ * \return a handle to the extra crash detail.
+ */
+crash_detail_t* _Nullable android_crash_detail_register(
+    const void* _Nonnull name, size_t name_size, const void* _Nullable data, size_t data_size) __INTRODUCED_IN(35);
+
+/**
+ * Unregister crash detail from being logged into tombstones.
+ *
+ * After this function returns, the lifetime of the objects crash_detail was
+ * constructed from no longer needs to be valid.
+ *
+ * Introduced in API 35.
+ *
+ * \param crash_detail the crash_detail that should be removed.
+ */
+void android_crash_detail_unregister(crash_detail_t* _Nonnull crash_detail) __INTRODUCED_IN(35);
+
+/**
+ * Replace data of crash detail.
+ *
+ * This is more efficient than using android_crash_detail_unregister followed by
+ * android_crash_detail_register. If you very frequently need to swap out the data,
+ * you can hold onto the crash_detail.
+ *
+ * Introduced in API 35.
+ *
+ * \param data the new buffer containing the extra detail bytes, or null to disable until
+ *             android_crash_detail_replace_data is called again with non-null data.
+ * \param data_size the number of bytes of the buffer pointed to by data.
+ */
+void android_crash_detail_replace_data(crash_detail_t* _Nonnull crash_detail, const void* _Nullable data, size_t data_size) __INTRODUCED_IN(35);
+
+/**
+ * Replace name of crash detail.
+ *
+ * This is more efficient than using android_crash_detail_unregister followed by
+ * android_crash_detail_register. If you very frequently need to swap out the name,
+ * you can hold onto the crash_detail.
+ *
+ * Introduced in API 35.
+ *
+ * \param name identifying name for this extra data.
+ * \param name_size number of bytes of the buffer pointed to by name
+ */
+void android_crash_detail_replace_name(crash_detail_t* _Nonnull crash_detail, const void* _Nonnull name, size_t name_size) __INTRODUCED_IN(35);
+
+__END_DECLS
diff --git a/libc/include/android/fdsan.h b/libc/include/android/fdsan.h
index 3de0649..4540498 100644
--- a/libc/include/android/fdsan.h
+++ b/libc/include/android/fdsan.h
@@ -126,6 +126,9 @@
 
   /* native_handle_t */
   ANDROID_FDSAN_OWNER_TYPE_NATIVE_HANDLE = 13,
+
+  /* android::Parcel */
+  ANDROID_FDSAN_OWNER_TYPE_PARCEL = 14,
 };
 
 /*
diff --git a/libc/include/android/set_abort_message.h b/libc/include/android/set_abort_message.h
index e92c6ec..a778057 100644
--- a/libc/include/android/set_abort_message.h
+++ b/libc/include/android/set_abort_message.h
@@ -30,7 +30,7 @@
 
 /**
  * @file android/set_abort_message.h
- * @brief Attach extra information to android crashes.
+ * @brief The android_set_abort_message() function.
  */
 
 #include <stddef.h>
@@ -43,59 +43,31 @@
 typedef struct crash_detail_t crash_detail_t;
 
 /**
- * android_set_abort_message() sets the abort message that will be shown
- * by [debuggerd](https://source.android.com/devices/tech/debug/native-crash).
+ * android_set_abort_message() sets the abort message passed to
+ * [debuggerd](https://source.android.com/devices/tech/debug/native-crash)
+ * for inclusion in any crash.
+ *
  * This is meant for use by libraries that deliberately abort so that they can
  * provide an explanation. It is used within bionic to implement assert() and
- * all FORTIFY/fdsan aborts.
- */
-void android_set_abort_message(const char* _Nullable __msg);
-
-/**
- * Register a new buffer to get logged into tombstones for crashes.
+ * all FORTIFY and fdsan failures.
  *
- * It will be added to both the tombstone proto in the crash_detail field, and
+ * The message appears directly in logcat at the time of crash. It will
+ * also be added to both the tombstone proto in the crash_detail field, and
  * in the tombstone text format.
  *
  * Tombstone proto definition:
  *   https://cs.android.com/android/platform/superproject/main/+/main:system/core/debuggerd/proto/tombstone.proto
  *
- * The lifetime of name and data has to be valid until the program crashes, or until
- * android_unregister_crash_detail is called.
+ * An app can get hold of these for any `REASON_CRASH_NATIVE` instance of
+ * `android.app.ApplicationExitInfo`.
+ *  https://developer.android.com/reference/android/app/ApplicationExitInfo#getTraceInputStream()
  *
- * Example usage:
- *   const char* stageName = "garbage_collection";
- *   crash_detail_t* cd = android_register_crash_detail("stage", stageName, strlen(stageName));
- *   do_garbage_collection();
- *   android_unregister_crash_detail(cd);
- *
- * If this example crashes in do_garbage_collection, a line will show up in the textual representation of the tombstone:
- *   Extra crash detail: stage: 'garbage_collection'
- *
- * Introduced in API 35.
- *
- * \param name identifying name for this extra data.
- *             this should generally be a human-readable debug string, but we are treating
- *             it as arbitrary bytes because it could be corrupted by the crash.
- * \param name_size number of bytes of the buffer pointed to by name
- * \param data a buffer containing the extra detail bytes
- * \param data_size number of bytes of the buffer pointed to by data
- *
- * \return a handle to the extra crash detail for use with android_unregister_crash_detail.
+ * The given message is copied at the time this function is called, and does
+ * not need to be valid until the crash actually happens, but typically this
+ * function is called immediately before aborting. See <android/crash_detail.h>
+ * for API more suited to the use case where the caller doesn't _expect_ a
+ * crash but would like to see the information _if_ a crash happens.
  */
-crash_detail_t* _Nullable android_register_crash_detail(
-    const void* _Nonnull name, size_t name_size, const void* _Nonnull data, size_t data_size) __INTRODUCED_IN(35);
-
-/**
- * Unregister crash detail from being logged into tombstones.
- *
- * After this function returns, the lifetime of the objects crash_detail was
- * constructed from no longer needs to be valid.
- *
- * Introduced in API 35.
- *
- * \param crash_detail the crash_detail that should be removed.
- */
-void android_unregister_crash_detail(crash_detail_t* _Nonnull crash_detail) __INTRODUCED_IN(35);
+void android_set_abort_message(const char* _Nullable __msg);
 
 __END_DECLS
diff --git a/libc/include/bits/fcntl.h b/libc/include/bits/fcntl.h
index 597aa6e..ee5a6e1 100644
--- a/libc/include/bits/fcntl.h
+++ b/libc/include/bits/fcntl.h
@@ -43,6 +43,6 @@
  *
  * The return value depends on the operation.
  */
-int fcntl(int __fd, int __cmd, ...);
+int fcntl(int __fd, int __op, ...);
 
 __END_DECLS
diff --git a/libc/include/bits/ioctl.h b/libc/include/bits/ioctl.h
index fd31a58..260eb7d 100644
--- a/libc/include/bits/ioctl.h
+++ b/libc/include/bits/ioctl.h
@@ -40,7 +40,7 @@
 /**
  * [ioctl(2)](http://man7.org/linux/man-pages/man2/ioctl.2.html) operates on device files.
  */
-int ioctl(int __fd, int __request, ...);
+int ioctl(int __fd, int __op, ...);
 
 /*
  * Work around unsigned -> signed conversion warnings: many common ioctl
@@ -57,7 +57,7 @@
  */
 #if !defined(BIONIC_IOCTL_NO_SIGNEDNESS_OVERLOAD)
 /* enable_if(1) just exists to break overloading ties. */
-int ioctl(int __fd, unsigned __request, ...) __overloadable __enable_if(1, "") __RENAME(ioctl);
+int ioctl(int __fd, unsigned __op, ...) __overloadable __enable_if(1, "") __RENAME(ioctl);
 #endif
 
 __END_DECLS
diff --git a/libc/include/bits/lockf.h b/libc/include/bits/lockf.h
index ec6e53c..d9f5987 100644
--- a/libc/include/bits/lockf.h
+++ b/libc/include/bits/lockf.h
@@ -56,12 +56,12 @@
  *
  * See also flock().
  */
-int lockf(int __fd, int __cmd, off_t __length) __RENAME_IF_FILE_OFFSET64(lockf64) __INTRODUCED_IN(24);
+int lockf(int __fd, int __op, off_t __length) __RENAME_IF_FILE_OFFSET64(lockf64) __INTRODUCED_IN(24);
 
 /**
  * Like lockf() but allows using a 64-bit length
  * even from a 32-bit process without `_FILE_OFFSET_BITS=64`.
  */
-int lockf64(int __fd, int __cmd, off64_t __length) __INTRODUCED_IN(24);
+int lockf64(int __fd, int __op, off64_t __length) __INTRODUCED_IN(24);
 
 __END_DECLS
diff --git a/libc/include/bits/page_size.h b/libc/include/bits/page_size.h
index ca434e5..df0cb7f 100644
--- a/libc/include/bits/page_size.h
+++ b/libc/include/bits/page_size.h
@@ -32,7 +32,7 @@
 
 __BEGIN_DECLS
 
-#if !defined(__BIONIC_NO_PAGE_SIZE_MACRO)
+#if !defined(__BIONIC_NO_PAGE_SIZE_MACRO) || defined(__BIONIC_DEPRECATED_PAGE_SIZE_MACRO)
 #define PAGE_SIZE 4096
 #define PAGE_MASK (~(PAGE_SIZE - 1))
 #endif
diff --git a/libc/include/netinet/ether.h b/libc/include/netinet/ether.h
index d570c18..4af7eda 100644
--- a/libc/include/netinet/ether.h
+++ b/libc/include/netinet/ether.h
@@ -40,7 +40,7 @@
 
 /**
  * [ether_ntoa(3)](http://man7.org/linux/man-pages/man3/ether_ntoa.3.html) returns a string
- * representation of the given Ethernet address.
+ * representation of the given Ethernet (MAC) address.
  *
  * Returns a pointer to a static buffer.
  */
@@ -48,7 +48,7 @@
 
 /**
  * [ether_ntoa_r(3)](http://man7.org/linux/man-pages/man3/ether_ntoa_r.3.html) returns a string
- * representation of the given Ethernet address.
+ * representation of the given Ethernet (MAC) address.
  *
  * Returns a pointer to the given buffer.
  */
@@ -56,7 +56,7 @@
 
 /**
  * [ether_aton(3)](http://man7.org/linux/man-pages/man3/ether_aton.3.html) returns an `ether_addr`
- * corresponding to the given Ethernet address string.
+ * corresponding to the given Ethernet (MAC) address string.
  *
  * Returns a pointer to a static buffer, or NULL if the given string isn't a valid MAC address.
  */
@@ -64,7 +64,7 @@
 
 /**
  * [ether_aton_r(3)](http://man7.org/linux/man-pages/man3/ether_aton_r.3.html) returns an
- * `ether_addr` corresponding to the given Ethernet address string.
+ * `ether_addr` corresponding to the given Ethernet (MAC) address string.
  *
  * Returns a pointer to the given buffer, or NULL if the given string isn't a valid MAC address.
  */
diff --git a/libc/include/spawn.h b/libc/include/spawn.h
index 6c34b98..3ce402f 100644
--- a/libc/include/spawn.h
+++ b/libc/include/spawn.h
@@ -55,7 +55,7 @@
 int posix_spawn(pid_t* _Nullable __pid, const char* _Nonnull __path, const posix_spawn_file_actions_t _Nullable * _Nullable __actions, const posix_spawnattr_t _Nullable * _Nullable __attr, char* const _Nonnull __argv[_Nonnull], char* const _Nullable __env[_Nullable]) __INTRODUCED_IN(28);
 int posix_spawnp(pid_t* _Nullable __pid, const char* _Nonnull __file, const posix_spawn_file_actions_t _Nullable * _Nullable __actions, const posix_spawnattr_t _Nullable * _Nullable __attr, char* const _Nonnull __argv[_Nonnull], char* const _Nullable __env[_Nullable]) __INTRODUCED_IN(28);
 
-int posix_spawnattr_init(posix_spawnattr_t _Nonnull * _Nonnull __attr) __INTRODUCED_IN(28);
+int posix_spawnattr_init(posix_spawnattr_t _Nullable * _Nonnull __attr) __INTRODUCED_IN(28);
 int posix_spawnattr_destroy(posix_spawnattr_t _Nonnull * _Nonnull __attr) __INTRODUCED_IN(28);
 
 int posix_spawnattr_setflags(posix_spawnattr_t _Nonnull * _Nonnull __attr, short __flags) __INTRODUCED_IN(28);
diff --git a/libc/include/sys/_system_properties.h b/libc/include/sys/_system_properties.h
index 079c825..078e857 100644
--- a/libc/include/sys/_system_properties.h
+++ b/libc/include/sys/_system_properties.h
@@ -41,6 +41,7 @@
 __BEGIN_DECLS
 
 #define PROP_SERVICE_NAME "property_service"
+#define PROP_SERVICE_FOR_SYSTEM_NAME "property_service_for_system"
 #define PROP_DIRNAME "/dev/__properties__"
 
 #define PROP_MSG_SETPROP 1
diff --git a/libc/include/sys/msg.h b/libc/include/sys/msg.h
index ad481a0..26071b1 100644
--- a/libc/include/sys/msg.h
+++ b/libc/include/sys/msg.h
@@ -46,7 +46,7 @@
 typedef __kernel_ulong_t msglen_t;
 
 /** Not useful on Android; disallowed by SELinux. */
-int msgctl(int __msg_id, int __cmd, struct msqid_ds* _Nullable __buf) __INTRODUCED_IN(26);
+int msgctl(int __msg_id, int __op, struct msqid_ds* _Nullable __buf) __INTRODUCED_IN(26);
 /** Not useful on Android; disallowed by SELinux. */
 int msgget(key_t __key, int __flags) __INTRODUCED_IN(26);
 /** Not useful on Android; disallowed by SELinux. */
diff --git a/libc/include/sys/prctl.h b/libc/include/sys/prctl.h
index ff03c33..1c80415 100644
--- a/libc/include/sys/prctl.h
+++ b/libc/include/sys/prctl.h
@@ -45,6 +45,6 @@
  *
  * Returns -1 and sets `errno` on failure; success values vary by option.
  */
-int prctl(int __option, ...);
+int prctl(int __op, ...);
 
 __END_DECLS
diff --git a/libc/include/sys/ptrace.h b/libc/include/sys/ptrace.h
index 022fc3a..66b30a1 100644
--- a/libc/include/sys/ptrace.h
+++ b/libc/include/sys/ptrace.h
@@ -59,7 +59,7 @@
 #define PT_GETSIGINFO PTRACE_GETSIGINFO
 #define PT_SETSIGINFO PTRACE_SETSIGINFO
 
-long ptrace(int __request, ...);
+long ptrace(int __op, ...);
 
 __END_DECLS
 
diff --git a/libc/include/sys/quota.h b/libc/include/sys/quota.h
index 79c653d..37f8925 100644
--- a/libc/include/sys/quota.h
+++ b/libc/include/sys/quota.h
@@ -51,6 +51,6 @@
  *
  * Available since API level 26.
  */
-int quotactl(int __cmd, const char* _Nullable __special, int __id, char* __BIONIC_COMPLICATED_NULLNESS __addr) __INTRODUCED_IN(26);
+int quotactl(int __op, const char* _Nullable __special, int __id, char* __BIONIC_COMPLICATED_NULLNESS __addr) __INTRODUCED_IN(26);
 
 __END_DECLS
diff --git a/libc/include/sys/reboot.h b/libc/include/sys/reboot.h
index 156d947..5d9e1a7 100644
--- a/libc/include/sys/reboot.h
+++ b/libc/include/sys/reboot.h
@@ -55,6 +55,6 @@
  * Does not return on successful reboot, returns 0 if CAD was successfully enabled/disabled,
  * and returns -1 and sets `errno` on failure.
  */
-int reboot(int __cmd);
+int reboot(int __op);
 
 __END_DECLS
diff --git a/libc/include/sys/sem.h b/libc/include/sys/sem.h
index f4256e2..5682282 100644
--- a/libc/include/sys/sem.h
+++ b/libc/include/sys/sem.h
@@ -51,7 +51,7 @@
   void* _Nullable __pad;
 };
 
-int semctl(int __sem_id, int __sem_num, int __cmd, ...) __INTRODUCED_IN(26);
+int semctl(int __sem_id, int __sem_num, int __op, ...) __INTRODUCED_IN(26);
 int semget(key_t __key, int __sem_count, int __flags) __INTRODUCED_IN(26);
 int semop(int __sem_id, struct sembuf* _Nonnull __ops, size_t __op_count) __INTRODUCED_IN(26);
 
diff --git a/libc/include/sys/shm.h b/libc/include/sys/shm.h
index 9d58046..fb6f20c 100644
--- a/libc/include/sys/shm.h
+++ b/libc/include/sys/shm.h
@@ -49,7 +49,7 @@
 /** Not useful on Android; disallowed by SELinux. */
 void* _Nonnull shmat(int __shm_id, const void* _Nullable __addr, int __flags) __INTRODUCED_IN(26);
 /** Not useful on Android; disallowed by SELinux. */
-int shmctl(int __shm_id, int __cmd, struct shmid_ds* _Nullable __buf) __INTRODUCED_IN(26);
+int shmctl(int __shm_id, int __op, struct shmid_ds* _Nullable __buf) __INTRODUCED_IN(26);
 /** Not useful on Android; disallowed by SELinux. */
 int shmdt(const void* _Nonnull __addr) __INTRODUCED_IN(26);
 /** Not useful on Android; disallowed by SELinux. */
diff --git a/libc/include/time.h b/libc/include/time.h
index 45c5c34..f448851 100644
--- a/libc/include/time.h
+++ b/libc/include/time.h
@@ -365,13 +365,14 @@
 
 /**
  * [clock_nanosleep(2)](http://man7.org/linux/man-pages/man2/clock_nanosleep.2.html)
- * sleeps for the given time as measured by the given clock.
+ * sleeps for the given time (or until the given time if the TIMER_ABSTIME flag
+ * is used), as measured by the given clock.
  *
  * Returns 0 on success, and returns -1 and returns an error number on failure.
  * If the sleep was interrupted by a signal, the return value will be `EINTR`
  * and `remainder` will be the amount of time remaining.
  */
-int clock_nanosleep(clockid_t __clock, int __flags, const struct timespec* _Nonnull __duration, struct timespec* _Nullable __remainder);
+int clock_nanosleep(clockid_t __clock, int __flags, const struct timespec* _Nonnull __time, struct timespec* _Nullable __remainder);
 
 /**
  * [clock_settime(2)](http://man7.org/linux/man-pages/man2/clock_settime.2.html)
diff --git a/libc/include/unistd.h b/libc/include/unistd.h
index c8cceb2..ee772a5 100644
--- a/libc/include/unistd.h
+++ b/libc/include/unistd.h
@@ -78,8 +78,41 @@
 
 __noreturn void _exit(int __status);
 
-pid_t  fork(void);
-pid_t  vfork(void) __returns_twice;
+/**
+ * [fork(2)](http://man7.org/linux/man-pages/man2/fork.2.html) creates a new
+ * process. fork() runs any handlers set by pthread_atfork().
+ *
+ * Returns 0 in the child, the pid of the child in the parent,
+ * and returns -1 and sets `errno` on failure.
+ */
+pid_t fork(void);
+
+/**
+ * _Fork() creates a new process. _Fork() differs from fork() in that it does
+ * not run any handlers set by pthread_atfork(). In addition to any user-defined
+ * ones, bionic uses pthread_atfork() handlers to ensure consistency of its own
+ * state, so the child should only call
+ * [POSIX async-safe](https://man7.org/linux/man-pages/man7/signal-safety.7.html)
+ * functions.
+ *
+ * Returns 0 in the child, the pid of the child in the parent,
+ * and returns -1 and sets `errno` on failure.
+ *
+ * Available since API level 35.
+ */
+pid_t _Fork(void) __INTRODUCED_IN(35);
+
+/**
+ * [vfork(2)](http://man7.org/linux/man-pages/man2/vfork.2.html) creates a new
+ * process. vfork() differs from fork() in that it does not run any handlers
+ * set by pthread_atfork(), and the parent is suspended until the child calls
+ * exec() or exits.
+ *
+ * Returns 0 in the child, the pid of the child in the parent,
+ * and returns -1 and sets `errno` on failure.
+ */
+pid_t vfork(void) __returns_twice;
+
 pid_t  getpid(void);
 pid_t  gettid(void) __attribute_const__;
 pid_t  getpgid(pid_t __pid);
diff --git a/libc/libc.map.txt b/libc/libc.map.txt
index ecdb25c..2c8ec07 100644
--- a/libc/libc.map.txt
+++ b/libc/libc.map.txt
@@ -1586,10 +1586,13 @@
 
 LIBC_V { # introduced=VanillaIceCream
   global:
-    android_register_crash_detail;
-    android_unregister_crash_detail;
+    android_crash_detail_register;
+    android_crash_detail_unregister;
+    android_crash_detail_replace_name;
+    android_crash_detail_replace_data;
     epoll_pwait2;
     epoll_pwait2_64;
+    _Fork;
     localtime_rz;
     mbsrtowcs_l;
     mktime_z;
diff --git a/libc/platform/bionic/set_abort_message_internal.h b/libc/platform/bionic/crash_detail_internal.h
similarity index 97%
rename from libc/platform/bionic/set_abort_message_internal.h
rename to libc/platform/bionic/crash_detail_internal.h
index 4dff3ac..d8508a5 100644
--- a/libc/platform/bionic/set_abort_message_internal.h
+++ b/libc/platform/bionic/crash_detail_internal.h
@@ -28,7 +28,7 @@
 
 #pragma once
 
-#include <android/set_abort_message.h>
+#include <android/crash_detail.h>
 #include <stddef.h>
 #include <sys/cdefs.h>
 
diff --git a/libc/private/bionic_globals.h b/libc/private/bionic_globals.h
index 23f2953..6f1e389 100644
--- a/libc/private/bionic_globals.h
+++ b/libc/private/bionic_globals.h
@@ -50,6 +50,7 @@
   uintptr_t heap_pointer_tag;
   _Atomic(bool) memtag_stack;
   _Atomic(bool) decay_time_enabled;
+  _Atomic(bool) memtag;
 
   // In order to allow a complete switch between dispatch tables without
   // the need for copying each function by function in the structure,
@@ -137,6 +138,7 @@
   bool initial_memtag_stack = false;
   int64_t heap_tagging_upgrade_timer_sec = 0;
 
+  void (*memtag_stack_dlopen_callback)() = nullptr;
   pthread_mutex_t crash_detail_page_lock = PTHREAD_MUTEX_INITIALIZER;
   crash_detail_page_t* crash_detail_page = nullptr;
 };
diff --git a/linker/linker.cpp b/linker/linker.cpp
index a12388c..b0caedd 100644
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -1695,13 +1695,31 @@
   }
 
   // Step 3: pre-link all DT_NEEDED libraries in breadth first order.
+  bool any_memtag_stack = false;
   for (auto&& task : load_tasks) {
     soinfo* si = task->get_soinfo();
     if (!si->is_linked() && !si->prelink_image()) {
       return false;
     }
+    // si->memtag_stack() needs to be called after si->prelink_image() which populates
+    // the dynamic section.
+    if (si->has_min_version(7) && si->memtag_stack()) {
+      any_memtag_stack = true;
+      LD_LOG(kLogDlopen,
+             "... load_library requesting stack MTE for: realpath=\"%s\", soname=\"%s\"",
+             si->get_realpath(), si->get_soname());
+    }
     register_soinfo_tls(si);
   }
+  if (any_memtag_stack) {
+    if (auto* cb = __libc_shared_globals()->memtag_stack_dlopen_callback) {
+      cb();
+    } else {
+      // find_library is used by the initial linking step, so we communicate that we
+      // want memtag_stack enabled to __libc_init_mte.
+      __libc_shared_globals()->initial_memtag_stack = true;
+    }
+  }
 
   // Step 4: Construct the global group. DF_1_GLOBAL bit is force set for LD_PRELOADed libs because
   // they must be added to the global group. Note: The DF_1_GLOBAL bit for a library is normally set
diff --git a/linker/linker_main.cpp b/linker/linker_main.cpp
index 5f5eba4..d6592af 100644
--- a/linker/linker_main.cpp
+++ b/linker/linker_main.cpp
@@ -404,9 +404,6 @@
                      strerror(errno));
     }
   }
-
-  __libc_init_mte(somain->memtag_dynamic_entries(), somain->phdr, somain->phnum, somain->load_bias,
-                  args.argv);
 #endif
 
   // Register the main executable and the linker upfront to have
@@ -496,6 +493,12 @@
     }
     si->increment_ref_count();
   }
+#if defined(__aarch64__)
+  // This has to happen after the find_libraries, which will have collected any possible
+  // libraries that request memtag_stack in the dynamic section.
+  __libc_init_mte(somain->memtag_dynamic_entries(), somain->phdr, somain->phnum, somain->load_bias,
+                  args.argv);
+#endif
 
   linker_finalize_static_tls();
   __libc_init_main_thread_final();
diff --git a/tests/Android.bp b/tests/Android.bp
index a62abab..0f4a942 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -834,6 +834,7 @@
         "cfi_test_helper",
         "cfi_test_helper2",
         "elftls_dlopen_ie_error_helper",
+        "elftls_dtv_resize_helper",
         "exec_linker_helper",
         "exec_linker_helper_lib",
         "heap_tagging_async_helper",
@@ -936,6 +937,8 @@
         "libtest_elftls_dynamic_filler_1",
         "libtest_elftls_dynamic_filler_2",
         "libtest_elftls_dynamic_filler_3",
+        "libtest_elftls_dynamic_filler_4",
+        "libtest_elftls_dynamic_filler_5",
         "libtest_elftls_shared_var",
         "libtest_elftls_shared_var_ie",
         "libtest_elftls_tprel",
@@ -1108,6 +1111,36 @@
 }
 
 cc_test {
+    name: "memtag_stack_dlopen_test",
+    enabled: false,
+    // This does not use bionic_tests_defaults because it is not supported on
+    // host.
+    arch: {
+        arm64: {
+            enabled: true,
+        },
+    },
+    sanitize: {
+        memtag_heap: true,
+        memtag_stack: false,
+    },
+    srcs: [
+        "memtag_stack_dlopen_test.cpp",
+    ],
+    shared_libs: [
+        "libbase",
+    ],
+    data_libs: ["libtest_simple_memtag_stack", "libtest_depends_on_simple_memtag_stack"],
+    data_bins: [
+        "testbinary_depends_on_simple_memtag_stack",
+        "testbinary_depends_on_depends_on_simple_memtag_stack",
+        "testbinary_is_stack_mte_after_dlopen"
+    ],
+    header_libs: ["bionic_libc_platform_headers"],
+    test_suites: ["device-tests"],
+}
+
+cc_test {
     name: "bionic-stress-tests",
     defaults: [
         "bionic_tests_defaults",
diff --git a/tests/NOTICE b/tests/NOTICE
index cc99d20..de95698 100644
--- a/tests/NOTICE
+++ b/tests/NOTICE
@@ -454,3 +454,31 @@
 
 -------------------------------------------------------------------
 
+Copyright (C) 2024 The Android Open Source Project
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+ * Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in
+   the documentation and/or other materials provided with the
+   distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+-------------------------------------------------------------------
+
diff --git a/tests/__cxa_demangle_test.cpp b/tests/__cxa_demangle_test.cpp
index d400619..e13410c 100644
--- a/tests/__cxa_demangle_test.cpp
+++ b/tests/__cxa_demangle_test.cpp
@@ -28,11 +28,39 @@
 
 #include <cxxabi.h>
 #include <gtest/gtest.h>
+#include <string.h>
 
 TEST(__cxa_demangle, cxa_demangle_fuzz_152588929) {
 #if defined(__aarch64__)
+  // Test the C++ demangler on an invalid mangled string. libc++abi currently
+  // parses it like so:
+  //    (1 "\006") (I (L e "eeEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE" E) E)
+  // There are a few interesting things about this mangled input:
+  //  - The IA64 C++ ABI specifies that an FP literal's hex chars are lowercase.
+  //    The libc++abi demangler currently accepts uppercase A-F digits, which is
+  //    confusing because 'E' is supposed to mark the end of the <expr-primary>.
+  //  - libc++abi uses snprintf("%a") which puts an unspecified number of bits
+  //    in the digit before the decimal point.
+  //  - The identifier name is "\006", and the IA64 C++ ABI spec is explicit
+  //    about not specifying the encoding for characters outside of
+  //    [_A-Za-z0-9].
+  //  - The 'e' type is documented as "long double, __float80", and in practice
+  //    the length of the literal depends on the arch. For arm64, it is a
+  //    128-bit FP type encoded using 32 hex chars. The situation with x86-64
+  //    Android OTOH is messy because Clang uses 'g' for its 128-bit
+  //    long double.
   char* p = abi::__cxa_demangle("1\006ILeeeEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE", 0, 0, 0);
-  ASSERT_STREQ("\x6<-0x1.cecececececececececececececep+11983", p);
+  if (p && !strcmp(p, "\x6<-0x1.cecececececececececececececep+11983")) {
+    // Prior to llvm.org/D77924, libc++abi left off the "L>" suffix.
+  } else if (p && !strcmp(p, "\x6<-0x1.cecececececececececececececep+11983L>")) {
+    // After llvm.org/D77924, the "L>" suffix is present. libc++abi
+    // accepts A-F digits but decodes each using (digit - 'a' + 10), turning 'E'
+    // into -18.
+  } else {
+    // TODO: Remove the other accepted outputs, because libc++abi probably
+    // should reject this input.
+    ASSERT_EQ(nullptr, p) << p;
+  }
   free(p);
 #endif
 }
diff --git a/tests/elftls_dl_test.cpp b/tests/elftls_dl_test.cpp
index e2fa3a0..bcb2b40 100644
--- a/tests/elftls_dl_test.cpp
+++ b/tests/elftls_dl_test.cpp
@@ -29,10 +29,9 @@
 #include <dlfcn.h>
 #include <link.h>
 
-#include <android-base/file.h>
-#include <android-base/test_utils.h>
 #include <gtest/gtest.h>
 
+#include <string>
 #include <thread>
 
 #include "gtest_globals.h"
@@ -155,71 +154,11 @@
 
 TEST(elftls_dl, dtv_resize) {
 #if defined(__BIONIC__)
-#define LOAD_LIB(soname) ({                           \
-    auto lib = dlopen(soname, RTLD_LOCAL | RTLD_NOW); \
-    ASSERT_NE(nullptr, lib);                          \
-    reinterpret_cast<int(*)()>(dlsym(lib, "bump"));   \
-  })
-
-  auto dtv = []() -> TlsDtv* { return __get_tcb_dtv(__get_bionic_tcb()); };
-
-  static_assert(sizeof(TlsDtv) == 3 * sizeof(void*),
-                "This test assumes that the Dtv has a 3-word header");
-
-  // Initially there are 4 modules (5 w/ hwasan):
-  //  - the main test executable
-  //  - libc
-  //  - libtest_elftls_shared_var
-  //  - libtest_elftls_tprel
-  //  - w/ hwasan: libclang_rt.hwasan
-
-  // The initial DTV is an empty DTV with no generation and a size of 0.
-  TlsDtv* zero_dtv = dtv();
-  ASSERT_EQ(0u, zero_dtv->count);
-  ASSERT_EQ(nullptr, zero_dtv->next);
-  ASSERT_EQ(kTlsGenerationNone, zero_dtv->generation);
-
-  // Load module 5 (6 w/ hwasan).
-  auto func1 = LOAD_LIB("libtest_elftls_dynamic_filler_1.so");
-  ASSERT_EQ(101, func1());
-
-  // After loading one module, the DTV should be initialized to the next
-  // power-of-2 size (including the header).
-  TlsDtv* initial_dtv = dtv();
-  ASSERT_EQ(running_with_hwasan() ? 13u : 5u, dtv()->count);
-  ASSERT_EQ(zero_dtv, initial_dtv->next);
-  ASSERT_LT(0u, initial_dtv->generation);
-
-  // Load module 6 (7 w/ hwasan).
-  auto func2 = LOAD_LIB("libtest_elftls_dynamic_filler_2.so");
-  ASSERT_EQ(102, func1());
-
-#if defined(__aarch64__)
-  // The arm64 TLSDESC resolver doesn't update the DTV if it is new enough for
-  // the given access.
-  ASSERT_EQ(running_with_hwasan() ? 13u : 5u, dtv()->count);
-#else
-  // __tls_get_addr updates the DTV anytime the generation counter changes.
-  ASSERT_EQ(13u, dtv()->count);
-#endif
-
-  ASSERT_EQ(201, func2());
-  TlsDtv* new_dtv = dtv();
-  if (!running_with_hwasan()) {
-    ASSERT_NE(initial_dtv, new_dtv);
-    ASSERT_EQ(initial_dtv, new_dtv->next);
-  }
-  ASSERT_EQ(13u, new_dtv->count);
-
-  // Load module 7 (8 w/ hwasan).
-  auto func3 = LOAD_LIB("libtest_elftls_dynamic_filler_3.so");
-  ASSERT_EQ(103, func1());
-  ASSERT_EQ(202, func2());
-  ASSERT_EQ(301, func3());
-
-  ASSERT_EQ(new_dtv, dtv());
-
-#undef LOAD_LIB
+  std::string helper = GetTestlibRoot() + "/elftls_dtv_resize_helper";
+  chmod(helper.c_str(), 0755);  // TODO: "x" lost in CTS, b/34945607
+  ExecTestHelper eth;
+  eth.SetArgs({helper.c_str(), nullptr});
+  eth.Run([&]() { execve(helper.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, nullptr);
 #else
   GTEST_SKIP() << "test doesn't apply to glibc";
 #endif
diff --git a/tests/grp_pwd_test.cpp b/tests/grp_pwd_test.cpp
index 16b8d5a..ddc0fc1 100644
--- a/tests/grp_pwd_test.cpp
+++ b/tests/grp_pwd_test.cpp
@@ -444,16 +444,33 @@
     return result;
   };
 
-  // AID_PRNG_SEEDER (1092) was added in TM-QPR2, but CTS is shared
-  // across Android 13 versions so we may or may not find it in this
-  // test (b/253185870).
-  if (android::base::GetIntProperty("ro.build.version.sdk", 0) == __ANDROID_API_T__) {
-#ifndef AID_PRNG_SEEDER
-#define AID_PRNG_SEEDER 1092
+  // AID_UPROBESTATS (1093) was added in V, but "trunk stable" means
+  // that the 2024Q builds don't have branches like the QPR builds used
+  // to, and are tested with the _previous_ release's CTS.
+  if (android::base::GetIntProperty("ro.build.version.sdk", 0) == __ANDROID_API_U__) {
+#if !defined(AID_UPROBESTATS)
+#define AID_UPROBESTATS 1093
 #endif
-    ids.erase(AID_PRNG_SEEDER);
-    expected_ids.erase(AID_PRNG_SEEDER);
+    ids.erase(AID_UPROBESTATS);
+    expected_ids.erase(AID_UPROBESTATS);
+    if (getpwuid(AID_UPROBESTATS)) {
+      EXPECT_STREQ(getpwuid(AID_UPROBESTATS)->pw_name, "uprobestats");
+    }
   }
+  // AID_VIRTUALMACHINE (3013) was added in V, but "trunk stable" means
+  // that the 2024Q builds don't have branches like the QPR builds used
+  // to, and are tested with the _previous_ release's CTS.
+  if (android::base::GetIntProperty("ro.build.version.sdk", 0) == __ANDROID_API_U__) {
+#if !defined(AID_VIRTUALMACHINE)
+#define AID_VIRTUALMACHINE 3013
+#endif
+    ids.erase(AID_VIRTUALMACHINE);
+    expected_ids.erase(AID_VIRTUALMACHINE);
+    if (getpwuid(AID_VIRTUALMACHINE)) {
+      EXPECT_STREQ(getpwuid(AID_VIRTUALMACHINE)->pw_name, "virtualmachine");
+    }
+  }
+
   EXPECT_EQ(expected_ids, ids) << return_differences();
 }
 #endif
diff --git a/tests/libs/Android.bp b/tests/libs/Android.bp
index 039d1e1..f640552 100644
--- a/tests/libs/Android.bp
+++ b/tests/libs/Android.bp
@@ -123,6 +123,39 @@
     ],
 }
 
+cc_test_library {
+    name: "libtest_elftls_dynamic_filler_4",
+    defaults: ["bionic_testlib_defaults"],
+    srcs: ["elftls_dynamic_filler.cpp"],
+    cflags: [
+        "-DTLS_FILLER=400",
+    ],
+}
+
+cc_test_library {
+    name: "libtest_elftls_dynamic_filler_5",
+    defaults: ["bionic_testlib_defaults"],
+    srcs: ["elftls_dynamic_filler.cpp"],
+    cflags: [
+        "-DTLS_FILLER=500",
+    ],
+}
+
+cc_test {
+    name: "elftls_dtv_resize_helper",
+    defaults: [
+        "bionic_testlib_defaults",
+        "bionic_targets_only",
+    ],
+    srcs: ["elftls_dtv_resize_helper.cpp"],
+    include_dirs: [
+        "bionic/libc",
+    ],
+    static_libs: [
+        "libbase",
+    ],
+}
+
 // -----------------------------------------------------------------------------
 // Library to test gnu-styled hash
 // -----------------------------------------------------------------------------
@@ -234,6 +267,61 @@
 }
 
 // -----------------------------------------------------------------------------
+// Libraries and binaries used by memtag_stack_dlopen_test tests
+// -----------------------------------------------------------------------------
+cc_test_library {
+    name: "libtest_simple_memtag_stack",
+    sanitize: {
+        memtag_stack: true,
+    },
+    srcs: ["dlopen_testlib_simple.cpp"],
+}
+
+cc_test_library {
+    name: "libtest_depends_on_simple_memtag_stack",
+    sanitize: {
+        memtag_stack: false,
+    },
+    shared_libs: [
+        "libtest_simple_memtag_stack",
+    ],
+    srcs: ["dlopen_testlib_depends_on_simple.cpp"],
+}
+
+cc_binary {
+    name: "testbinary_is_stack_mte_after_dlopen",
+    sanitize: {
+        memtag_stack: false,
+        memtag_heap: true,
+    },
+    srcs: ["testbinary_is_stack_mte_after_dlopen.cpp"],
+}
+
+cc_binary {
+    name: "testbinary_depends_on_simple_memtag_stack",
+    sanitize: {
+        memtag_stack: false,
+        memtag_heap: true,
+    },
+    shared_libs: [
+        "libtest_simple_memtag_stack",
+    ],
+    srcs: ["testbinary_is_stack_mte.cpp"],
+}
+
+cc_binary {
+    name: "testbinary_depends_on_depends_on_simple_memtag_stack",
+    sanitize: {
+        memtag_stack: false,
+        memtag_heap: true,
+    },
+    shared_libs: [
+        "libtest_depends_on_simple_memtag_stack",
+    ],
+    srcs: ["testbinary_is_stack_mte.cpp"],
+}
+
+// -----------------------------------------------------------------------------
 // Libraries used by hwasan_test
 // -----------------------------------------------------------------------------
 cc_test_library {
diff --git a/libc/platform/bionic/set_abort_message_internal.h b/tests/libs/dlopen_testlib_depends_on_simple.cpp
similarity index 76%
copy from libc/platform/bionic/set_abort_message_internal.h
copy to tests/libs/dlopen_testlib_depends_on_simple.cpp
index 4dff3ac..3652be8 100644
--- a/libc/platform/bionic/set_abort_message_internal.h
+++ b/tests/libs/dlopen_testlib_depends_on_simple.cpp
@@ -26,24 +26,11 @@
  * SUCH DAMAGE.
  */
 
-#pragma once
+#include <stdint.h>
+#include <stdlib.h>
 
-#include <android/set_abort_message.h>
-#include <stddef.h>
-#include <sys/cdefs.h>
+extern "C" bool dlopen_testlib_simple_func();
 
-struct crash_detail_t {
-  const char* name;
-  size_t name_size;
-  const char* data;
-  size_t data_size;
-  crash_detail_t* prev_free;
-};
-
-constexpr auto kNumCrashDetails = 128;
-
-struct crash_detail_page_t {
-  struct crash_detail_page_t* prev;
-  size_t used;
-  struct crash_detail_t crash_details[kNumCrashDetails];
-};
+extern "C" bool dlopen_testlib_call_simple_func() {
+  return dlopen_testlib_simple_func();
+}
diff --git a/tests/libs/elftls_dtv_resize_helper.cpp b/tests/libs/elftls_dtv_resize_helper.cpp
new file mode 100644
index 0000000..340d5df
--- /dev/null
+++ b/tests/libs/elftls_dtv_resize_helper.cpp
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <dlfcn.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <functional>
+#include <iostream>
+
+#include "bionic/pthread_internal.h"
+
+constexpr bool kDumpModulesForDebugging = false;
+
+// The old external/libcxx doesn't have operator<< for nullptr.
+// TODO(b/175635923): Remove this hack after upgrading libc++.
+template <class T>
+T fix_nullptr(T&& arg) {
+  return arg;
+}
+void* fix_nullptr(nullptr_t arg) {
+  return static_cast<void*>(arg);
+}
+
+template <class Val1, class Val2, class Compare>
+void check(int line, const char* val1_expr, Val1&& val1, const char* val2_expr, Val2&& val2,
+           Compare compare) {
+  if (!compare(val1, val2)) {
+    std::cerr << __FILE__ << ":" << line << ": assertion failed: LHS(" << val1_expr << ") is "
+              << fix_nullptr(val1) << ", RHS(" << val2_expr << ") is " << fix_nullptr(val2) << "\n"
+              << std::flush;
+    abort();
+  }
+}
+
+#define ASSERT_EQ(val1, val2) check(__LINE__, #val1, val1, #val2, val2, std::equal_to())
+#define ASSERT_NE(val1, val2) check(__LINE__, #val1, val1, #val2, val2, std::not_equal_to())
+#define ASSERT_LT(val1, val2) check(__LINE__, #val1, val1, #val2, val2, std::less())
+#define ASSERT_LE(val1, val2) check(__LINE__, #val1, val1, #val2, val2, std::less_equal())
+
+static size_t highest_loaded_modid() {
+  size_t result = 0;
+  auto update_result = [](struct dl_phdr_info* info, size_t size __unused, void* data) {
+    size_t& result = *reinterpret_cast<size_t*>(data);
+    if (kDumpModulesForDebugging) {
+      fprintf(stderr, "module %s: TLS modid %zu\n", info->dlpi_name, info->dlpi_tls_modid);
+    }
+    result = std::max(result, info->dlpi_tls_modid);
+    return 0;
+  };
+  dl_iterate_phdr(update_result, &result);
+  return result;
+}
+
+static TlsDtv* dtv() {
+  return __get_tcb_dtv(__get_bionic_tcb());
+}
+
+static size_t highest_modid_in_dtv() {
+  TlsDtv* current_dtv = dtv();
+  size_t result = 0;
+  for (size_t i = 0; i < current_dtv->count; ++i) {
+    if (current_dtv->modules[i] != nullptr) {
+      result = __tls_module_idx_to_id(i);
+    }
+  }
+  return result;
+}
+
+// Unused, but ensures that the test executable has a TLS segment. With a
+// new-enough libc++_static.a, the test executable will tend to has a TLS
+// segment to hold the libc++ EH globals pointer.
+__thread int g_tls_var_placeholder = 42;
+
+int main() {
+  // Prevent this TLS variable from being optimized away.
+  ASSERT_EQ(42, g_tls_var_placeholder);
+
+  auto load_lib = [](const char* soname) {
+    void* lib = dlopen(soname, RTLD_LOCAL | RTLD_NOW);
+    ASSERT_NE(nullptr, lib);
+    auto func = reinterpret_cast<int (*)()>(dlsym(lib, "bump"));
+    ASSERT_NE(nullptr, func);
+    return func;
+  };
+
+  static_assert(sizeof(TlsDtv) == 3 * sizeof(void*),
+                "This test assumes that the Dtv has a 3-word header");
+
+  // Initially there are 2-4 modules:
+  //  - 1: test executable
+  //  - 2: libc
+  //  - 3: libc++ (when using a new-enough libc++)
+  //  - 4: libclang_rt.hwasan (when running with HWASan)
+  size_t first_filler_modid = highest_loaded_modid() + 1;
+  ASSERT_LE(2, highest_loaded_modid());
+  ASSERT_LE(highest_loaded_modid(), 4);
+
+  // The initial DTV is an empty DTV with no generation and a size of 0.
+  TlsDtv* zero_dtv = dtv();
+  ASSERT_EQ(0u, zero_dtv->count);
+  ASSERT_EQ(nullptr, zero_dtv->next);
+  ASSERT_EQ(kTlsGenerationNone, zero_dtv->generation);
+
+  // Load a module. The DTV is still empty unless the TLS variable is accessed.
+  auto func1 = load_lib("libtest_elftls_dynamic_filler_1.so");
+  ASSERT_EQ(zero_dtv, dtv());
+  ASSERT_EQ(first_filler_modid, highest_loaded_modid());
+
+  // After accessing a TLS variable, the DTV should be initialized. It should be
+  // 8 words in size, with a 5-entry capacity.
+  ASSERT_EQ(101, func1());
+  TlsDtv* initial_dtv = dtv();
+  ASSERT_EQ(5u, dtv()->count);
+  ASSERT_EQ(zero_dtv, initial_dtv->next);
+  ASSERT_LT(0u, initial_dtv->generation);
+  ASSERT_EQ(first_filler_modid, highest_modid_in_dtv());
+  ASSERT_NE(nullptr, initial_dtv->modules[__tls_module_id_to_idx(first_filler_modid)]);
+
+  size_t current_generation = initial_dtv->generation;
+
+  // Fill the rest of the DTV up. (i.e. Ensure that exactly 5 modules with TLS
+  // segments are loaded.)
+  auto fill_entry = [&](size_t modid, const char* soname, int tls_var_value) {
+    if (highest_modid_in_dtv() == modid - 1) {
+      auto func = load_lib(soname);
+
+      // Loading the module doesn't affect the DTV yet.
+      ASSERT_EQ(initial_dtv, dtv());
+      ASSERT_EQ(modid, highest_loaded_modid());
+      ASSERT_EQ(modid - 1, highest_modid_in_dtv());
+      ASSERT_EQ(current_generation, initial_dtv->generation);
+
+      // Access the TLS variable, which will allocate it in the DTV.
+      ASSERT_EQ(tls_var_value, func());
+
+      // Verify allocation and a bumped generation.
+      ASSERT_EQ(initial_dtv, dtv());
+      ASSERT_EQ(modid, highest_modid_in_dtv());
+      ASSERT_LT(current_generation, initial_dtv->generation);
+      current_generation = initial_dtv->generation;
+    }
+  };
+
+  fill_entry(4u, "libtest_elftls_dynamic_filler_2.so", 201);
+  fill_entry(5u, "libtest_elftls_dynamic_filler_3.so", 301);
+  ASSERT_EQ(5u, highest_modid_in_dtv());
+
+  // Load module 6, which will require doubling the size of the DTV.
+  auto func4 = load_lib("libtest_elftls_dynamic_filler_4.so");
+  ASSERT_EQ(6u, highest_loaded_modid());
+  ASSERT_EQ(5u, highest_modid_in_dtv());
+  ASSERT_EQ(initial_dtv, dtv());
+
+  // Access a TLS variable from the first filler module.
+  ASSERT_EQ(102, func1());
+  ASSERT_EQ(5u, highest_modid_in_dtv());
+#if defined(__aarch64__)
+  // The arm64 TLSDESC resolver doesn't update the DTV if it is new enough for
+  // the given access.
+  ASSERT_EQ(initial_dtv, dtv());
+  ASSERT_EQ(5u, dtv()->count);
+  ASSERT_EQ(current_generation, dtv()->generation);
+#else
+  // __tls_get_addr updates the DTV anytime the generation counter changes, but
+  // the highest modid in the DTV is still 5, because module 6 hasn't been
+  // allocated yet.
+  ASSERT_NE(initial_dtv, dtv());
+  ASSERT_EQ(13u, dtv()->count);
+  ASSERT_LT(current_generation, dtv()->generation);
+#endif
+
+  // Accessing the TLS variable in the latest module will always expand the DTV.
+  ASSERT_EQ(401, func4());
+  TlsDtv* new_dtv = dtv();
+  ASSERT_NE(initial_dtv, new_dtv);
+  ASSERT_EQ(initial_dtv, new_dtv->next);
+  ASSERT_EQ(13u, new_dtv->count);
+  ASSERT_LT(current_generation, new_dtv->generation);
+  ASSERT_EQ(6u, highest_modid_in_dtv());
+  current_generation = new_dtv->generation;
+
+  // Load one more filler, module 7.
+  auto func5 = load_lib("libtest_elftls_dynamic_filler_5.so");
+  ASSERT_EQ(103, func1());
+  ASSERT_EQ(402, func4());
+  ASSERT_EQ(6u, highest_modid_in_dtv());
+  ASSERT_EQ(501, func5());
+  ASSERT_EQ(7u, highest_modid_in_dtv());
+
+  // Verify that no new DTV has been allocated.
+  ASSERT_EQ(new_dtv, dtv());
+  ASSERT_EQ(13u, new_dtv->count);
+  ASSERT_LT(current_generation, new_dtv->generation);
+
+  return 0;
+}
diff --git a/libc/platform/bionic/set_abort_message_internal.h b/tests/libs/testbinary_is_stack_mte.cpp
similarity index 76%
copy from libc/platform/bionic/set_abort_message_internal.h
copy to tests/libs/testbinary_is_stack_mte.cpp
index 4dff3ac..d8074d5 100644
--- a/libc/platform/bionic/set_abort_message_internal.h
+++ b/tests/libs/testbinary_is_stack_mte.cpp
@@ -26,24 +26,25 @@
  * SUCH DAMAGE.
  */
 
-#pragma once
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
 
-#include <android/set_abort_message.h>
-#include <stddef.h>
-#include <sys/cdefs.h>
+#include "../mte_utils.h"
+#include "CHECK.h"
 
-struct crash_detail_t {
-  const char* name;
-  size_t name_size;
-  const char* data;
-  size_t data_size;
-  crash_detail_t* prev_free;
-};
+#if defined(__BIONIC__) && defined(__aarch64__)
 
-constexpr auto kNumCrashDetails = 128;
+extern "C" int main(int, char**) {
+  int ret = is_stack_mte_on() ? 0 : 1;
+  printf("RAN\n");
+  return ret;
+}
 
-struct crash_detail_page_t {
-  struct crash_detail_page_t* prev;
-  size_t used;
-  struct crash_detail_t crash_details[kNumCrashDetails];
-};
+#else
+
+extern "C" int main(int, char**) {
+  printf("RAN\n");
+  return 1;
+}
+#endif
diff --git a/tests/libs/testbinary_is_stack_mte_after_dlopen.cpp b/tests/libs/testbinary_is_stack_mte_after_dlopen.cpp
new file mode 100644
index 0000000..937ac4c
--- /dev/null
+++ b/tests/libs/testbinary_is_stack_mte_after_dlopen.cpp
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2024 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+#include <condition_variable>
+#include <thread>
+
+#include <dlfcn.h>
+#include <inttypes.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#include "../mte_utils.h"
+#include "CHECK.h"
+
+#if defined(__BIONIC__) && defined(__aarch64__)
+
+enum State { kInit, kThreadStarted, kStackRemapped };
+
+// We can't use pthread_getattr_np because that uses the rlimit rather than the actual mapping
+// bounds.
+static void find_main_stack_limits(uintptr_t* low, uintptr_t* high) {
+  uintptr_t startstack = reinterpret_cast<uintptr_t>(__builtin_frame_address(0));
+
+  // Hunt for the region that contains that address.
+  FILE* fp = fopen("/proc/self/maps", "re");
+  if (fp == nullptr) {
+    abort();
+  }
+  char line[BUFSIZ];
+  while (fgets(line, sizeof(line), fp) != nullptr) {
+    uintptr_t lo, hi;
+    if (sscanf(line, "%" SCNxPTR "-%" SCNxPTR, &lo, &hi) == 2) {
+      if (lo <= startstack && startstack <= hi) {
+        *low = lo;
+        *high = hi;
+        fclose(fp);
+        return;
+      }
+    }
+  }
+  abort();
+}
+
+template <typename Fn>
+unsigned int fault_new_stack_page(uintptr_t low, Fn f) {
+  uintptr_t new_low;
+  uintptr_t new_high;
+  volatile char buf[4096];
+  buf[4095] = 1;
+  find_main_stack_limits(&new_low, &new_high);
+  if (new_low < low) {
+    f();
+    return new_high;
+  }
+  // Useless, but should defeat TCO.
+  return new_low + fault_new_stack_page(low, f);
+}
+extern "C" int main(int argc, char** argv) {
+  if (argc < 2) {
+    return 1;
+  }
+  const char* path = argv[1];
+  CHECK(access(path, F_OK) == 0);  // Verify test setup.
+  CHECK(!is_stack_mte_on());
+  std::mutex m;
+  std::condition_variable cv;
+  State state = kInit;
+
+  bool is_early_thread_mte_on = false;
+  std::thread early_th([&] {
+    {
+      std::lock_guard lk(m);
+      state = kThreadStarted;
+    }
+    cv.notify_one();
+    {
+      std::unique_lock lk(m);
+      cv.wait(lk, [&] { return state == kStackRemapped; });
+    }
+    is_early_thread_mte_on = is_stack_mte_on();
+  });
+  {
+    std::unique_lock lk(m);
+    cv.wait(lk, [&] { return state == kThreadStarted; });
+  }
+  void* handle = dlopen(path, RTLD_NOW);
+  {
+    std::lock_guard lk(m);
+    state = kStackRemapped;
+  }
+  cv.notify_one();
+  CHECK(handle != nullptr);
+  CHECK(is_stack_mte_on());
+
+  bool new_stack_page_mte_on = false;
+  uintptr_t low;
+  uintptr_t high;
+  find_main_stack_limits(&low, &high);
+  fault_new_stack_page(low, [&] { new_stack_page_mte_on = is_stack_mte_on(); });
+  CHECK(new_stack_page_mte_on);
+
+  bool is_late_thread_mte_on = false;
+  std::thread late_th([&] { is_late_thread_mte_on = is_stack_mte_on(); });
+  late_th.join();
+  early_th.join();
+  CHECK(is_late_thread_mte_on);
+  CHECK(is_early_thread_mte_on);
+  printf("RAN\n");
+  return 0;
+}
+
+#else
+extern "C" int main(int, char**) {
+  return 1;
+}
+#endif
diff --git a/tests/memtag_stack_dlopen_test.cpp b/tests/memtag_stack_dlopen_test.cpp
new file mode 100644
index 0000000..68ddb81
--- /dev/null
+++ b/tests/memtag_stack_dlopen_test.cpp
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2023 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <thread>
+
+#include <dlfcn.h>
+#include <stdlib.h>
+
+#include <gtest/gtest.h>
+
+#include <android-base/silent_death_test.h>
+#include <android-base/test_utils.h>
+#include "mte_utils.h"
+#include "utils.h"
+
+TEST(MemtagStackDlopenTest, DependentBinaryGetsMemtagStack) {
+#if defined(__BIONIC__) && defined(__aarch64__)
+  if (!running_with_mte()) GTEST_SKIP() << "Test requires MTE.";
+  if (is_stack_mte_on())
+    GTEST_SKIP() << "Stack MTE needs to be off for this test. Are you running fullmte?";
+
+  std::string path =
+      android::base::GetExecutableDirectory() + "/testbinary_depends_on_simple_memtag_stack";
+  ExecTestHelper eth;
+  std::string ld_library_path = "LD_LIBRARY_PATH=" + android::base::GetExecutableDirectory();
+  eth.SetArgs({path.c_str(), nullptr});
+  eth.SetEnv({ld_library_path.c_str(), nullptr});
+  eth.Run([&]() { execve(path.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, "RAN");
+#else
+  GTEST_SKIP() << "requires bionic arm64";
+#endif
+}
+
+TEST(MemtagStackDlopenTest, DependentBinaryGetsMemtagStack2) {
+#if defined(__BIONIC__) && defined(__aarch64__)
+  if (!running_with_mte()) GTEST_SKIP() << "Test requires MTE.";
+  if (is_stack_mte_on())
+    GTEST_SKIP() << "Stack MTE needs to be off for this test. Are you running fullmte?";
+
+  std::string path = android::base::GetExecutableDirectory() +
+                     "/testbinary_depends_on_depends_on_simple_memtag_stack";
+  ExecTestHelper eth;
+  std::string ld_library_path = "LD_LIBRARY_PATH=" + android::base::GetExecutableDirectory();
+  eth.SetArgs({path.c_str(), nullptr});
+  eth.SetEnv({ld_library_path.c_str(), nullptr});
+  eth.Run([&]() { execve(path.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, "RAN");
+#else
+  GTEST_SKIP() << "requires bionic arm64";
+#endif
+}
+
+TEST(MemtagStackDlopenTest, DlopenRemapsStack) {
+#if defined(__BIONIC__) && defined(__aarch64__)
+  // If this test is failing, look at crash logcat for why the test binary died.
+  if (!running_with_mte()) GTEST_SKIP() << "Test requires MTE.";
+  if (is_stack_mte_on())
+    GTEST_SKIP() << "Stack MTE needs to be off for this test. Are you running fullmte?";
+
+  std::string path =
+      android::base::GetExecutableDirectory() + "/testbinary_is_stack_mte_after_dlopen";
+  std::string lib_path =
+      android::base::GetExecutableDirectory() + "/libtest_simple_memtag_stack.so";
+  ExecTestHelper eth;
+  std::string ld_library_path = "LD_LIBRARY_PATH=" + android::base::GetExecutableDirectory();
+  eth.SetArgs({path.c_str(), lib_path.c_str(), nullptr});
+  eth.SetEnv({ld_library_path.c_str(), nullptr});
+  eth.Run([&]() { execve(path.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, "RAN");
+#else
+  GTEST_SKIP() << "requires bionic arm64";
+#endif
+}
+
+TEST(MemtagStackDlopenTest, DlopenRemapsStack2) {
+#if defined(__BIONIC__) && defined(__aarch64__)
+  // If this test is failing, look at crash logcat for why the test binary died.
+  if (!running_with_mte()) GTEST_SKIP() << "Test requires MTE.";
+  if (is_stack_mte_on())
+    GTEST_SKIP() << "Stack MTE needs to be off for this test. Are you running fullmte?";
+
+  std::string path =
+      android::base::GetExecutableDirectory() + "/testbinary_is_stack_mte_after_dlopen";
+  std::string lib_path =
+      android::base::GetExecutableDirectory() + "/libtest_depends_on_simple_memtag_stack.so";
+  ExecTestHelper eth;
+  std::string ld_library_path = "LD_LIBRARY_PATH=" + android::base::GetExecutableDirectory();
+  eth.SetArgs({path.c_str(), lib_path.c_str(), nullptr});
+  eth.SetEnv({ld_library_path.c_str(), nullptr});
+  eth.Run([&]() { execve(path.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0, "RAN");
+#else
+  GTEST_SKIP() << "requires bionic arm64";
+#endif
+}
diff --git a/libc/platform/bionic/set_abort_message_internal.h b/tests/mte_utils.h
similarity index 77%
copy from libc/platform/bionic/set_abort_message_internal.h
copy to tests/mte_utils.h
index 4dff3ac..6e8385c 100644
--- a/libc/platform/bionic/set_abort_message_internal.h
+++ b/tests/mte_utils.h
@@ -28,22 +28,16 @@
 
 #pragma once
 
-#include <android/set_abort_message.h>
-#include <stddef.h>
-#include <sys/cdefs.h>
+#if defined(__BIONIC__) && defined(__aarch64__)
 
-struct crash_detail_t {
-  const char* name;
-  size_t name_size;
-  const char* data;
-  size_t data_size;
-  crash_detail_t* prev_free;
-};
+__attribute__((target("mte"))) static bool is_stack_mte_on() {
+  alignas(16) int x = 0;
+  void* p = reinterpret_cast<void*>(reinterpret_cast<uintptr_t>(&x) + (1UL << 57));
+  void* p_cpy = p;
+  __builtin_arm_stg(p);
+  p = __builtin_arm_ldg(p);
+  __builtin_arm_stg(&x);
+  return p == p_cpy;
+}
 
-constexpr auto kNumCrashDetails = 128;
-
-struct crash_detail_page_t {
-  struct crash_detail_page_t* prev;
-  size_t used;
-  struct crash_detail_t crash_details[kNumCrashDetails];
-};
+#endif
diff --git a/tests/netinet_ether_test.cpp b/tests/netinet_ether_test.cpp
index af020ec..d7b81eb 100644
--- a/tests/netinet_ether_test.cpp
+++ b/tests/netinet_ether_test.cpp
@@ -56,4 +56,5 @@
   ASSERT_TRUE(ether_aton_r("12:34:56:78:9a:bc ", &addr) == nullptr);
   ASSERT_TRUE(ether_aton_r("g2:34:56:78:9a:bc ", &addr) == nullptr);
   ASSERT_TRUE(ether_aton_r("1G:34:56:78:9a:bc ", &addr) == nullptr);
+  ASSERT_TRUE(ether_aton_r("123:34:56:78:9a:bc ", &addr) == nullptr);
 }
diff --git a/tests/pthread_test.cpp b/tests/pthread_test.cpp
index 1a882be..2bf755b 100644
--- a/tests/pthread_test.cpp
+++ b/tests/pthread_test.cpp
@@ -1423,10 +1423,11 @@
 static void AtForkChild1() { g_atfork_child_calls = (g_atfork_child_calls * 10) + 1; }
 static void AtForkChild2() { g_atfork_child_calls = (g_atfork_child_calls * 10) + 2; }
 
-TEST(pthread, pthread_atfork_smoke) {
+TEST(pthread, pthread_atfork_smoke_fork) {
   ASSERT_EQ(0, pthread_atfork(AtForkPrepare1, AtForkParent1, AtForkChild1));
   ASSERT_EQ(0, pthread_atfork(AtForkPrepare2, AtForkParent2, AtForkChild2));
 
+  g_atfork_prepare_calls = g_atfork_parent_calls = g_atfork_child_calls = 0;
   pid_t pid = fork();
   ASSERT_NE(-1, pid) << strerror(errno);
 
@@ -1442,6 +1443,44 @@
   AssertChildExited(pid, 0);
 }
 
+TEST(pthread, pthread_atfork_smoke_vfork) {
+  ASSERT_EQ(0, pthread_atfork(AtForkPrepare1, AtForkParent1, AtForkChild1));
+  ASSERT_EQ(0, pthread_atfork(AtForkPrepare2, AtForkParent2, AtForkChild2));
+
+  g_atfork_prepare_calls = g_atfork_parent_calls = g_atfork_child_calls = 0;
+  pid_t pid = vfork();
+  ASSERT_NE(-1, pid) << strerror(errno);
+
+  // atfork handlers are not called.
+  if (pid == 0) {
+    ASSERT_EQ(0, g_atfork_child_calls);
+    _exit(0);
+  }
+  ASSERT_EQ(0, g_atfork_parent_calls);
+  ASSERT_EQ(0, g_atfork_prepare_calls);
+  AssertChildExited(pid, 0);
+}
+
+TEST(pthread, pthread_atfork_smoke__Fork) {
+#if defined(__BIONIC__)
+  ASSERT_EQ(0, pthread_atfork(AtForkPrepare1, AtForkParent1, AtForkChild1));
+  ASSERT_EQ(0, pthread_atfork(AtForkPrepare2, AtForkParent2, AtForkChild2));
+
+  g_atfork_prepare_calls = g_atfork_parent_calls = g_atfork_child_calls = 0;
+  pid_t pid = _Fork();
+  ASSERT_NE(-1, pid) << strerror(errno);
+
+  // atfork handlers are not called.
+  if (pid == 0) {
+    ASSERT_EQ(0, g_atfork_child_calls);
+    _exit(0);
+  }
+  ASSERT_EQ(0, g_atfork_parent_calls);
+  ASSERT_EQ(0, g_atfork_prepare_calls);
+  AssertChildExited(pid, 0);
+#endif
+}
+
 TEST(pthread, pthread_attr_getscope) {
   pthread_attr_t attr;
   ASSERT_EQ(0, pthread_attr_init(&attr));
diff --git a/tests/unistd_test.cpp b/tests/unistd_test.cpp
index 88f5851..78b55c1 100644
--- a/tests/unistd_test.cpp
+++ b/tests/unistd_test.cpp
@@ -440,6 +440,22 @@
   TestSyncFunction(syncfs);
 }
 
+TEST(UNISTD_TEST, _Fork) {
+#if defined(__BIONIC__)
+  pid_t rc = _Fork();
+  ASSERT_NE(-1, rc);
+  if (rc == 0) {
+    _exit(66);
+  }
+
+  int status;
+  pid_t wait_result = waitpid(rc, &status, 0);
+  ASSERT_EQ(wait_result, rc);
+  ASSERT_TRUE(WIFEXITED(status));
+  ASSERT_EQ(66, WEXITSTATUS(status));
+#endif
+}
+
 TEST(UNISTD_TEST, vfork) {
 #if defined(__BIONIC__)
   pthread_internal_t* self = __get_thread();
@@ -753,22 +769,36 @@
 
 TEST(UNISTD_TEST, pathconf_fpathconf) {
   TemporaryFile tf;
-  long rc = 0L;
+  long l;
+
   // As a file system's block size is always power of 2, the configure values
   // for ALLOC and XFER should be power of 2 as well.
-  rc = pathconf(tf.path, _PC_ALLOC_SIZE_MIN);
-  ASSERT_TRUE(rc > 0 && powerof2(rc));
-  rc = pathconf(tf.path, _PC_REC_MIN_XFER_SIZE);
-  ASSERT_TRUE(rc > 0 && powerof2(rc));
-  rc = pathconf(tf.path, _PC_REC_XFER_ALIGN);
-  ASSERT_TRUE(rc > 0 && powerof2(rc));
+  l = pathconf(tf.path, _PC_ALLOC_SIZE_MIN);
+  ASSERT_TRUE(l > 0 && powerof2(l));
+  l = pathconf(tf.path, _PC_REC_MIN_XFER_SIZE);
+  ASSERT_TRUE(l > 0 && powerof2(l));
+  l = pathconf(tf.path, _PC_REC_XFER_ALIGN);
+  ASSERT_TRUE(l > 0 && powerof2(l));
 
-  rc = fpathconf(tf.fd, _PC_ALLOC_SIZE_MIN);
-  ASSERT_TRUE(rc > 0 && powerof2(rc));
-  rc = fpathconf(tf.fd, _PC_REC_MIN_XFER_SIZE);
-  ASSERT_TRUE(rc > 0 && powerof2(rc));
-  rc = fpathconf(tf.fd, _PC_REC_XFER_ALIGN);
-  ASSERT_TRUE(rc > 0 && powerof2(rc));
+  l = fpathconf(tf.fd, _PC_ALLOC_SIZE_MIN);
+  ASSERT_TRUE(l > 0 && powerof2(l));
+  l = fpathconf(tf.fd, _PC_REC_MIN_XFER_SIZE);
+  ASSERT_TRUE(l > 0 && powerof2(l));
+  l = fpathconf(tf.fd, _PC_REC_XFER_ALIGN);
+  ASSERT_TRUE(l > 0 && powerof2(l));
+
+  // Check that the "I can't answer that, you'll have to try it and see"
+  // cases don't set errno.
+  int names[] = {
+      _PC_ASYNC_IO, _PC_PRIO_IO, _PC_REC_INCR_XFER_SIZE, _PC_REC_MAX_XFER_SIZE, _PC_SYMLINK_MAX,
+      _PC_SYNC_IO,  -1};
+  for (size_t i = 0; names[i] != -1; i++) {
+    errno = 0;
+    ASSERT_EQ(-1, pathconf(tf.path, names[i])) << names[i];
+    ASSERT_ERRNO(0) << names[i];
+    ASSERT_EQ(-1, fpathconf(tf.fd, names[i])) << names[i];
+    ASSERT_ERRNO(0) << names[i];
+  }
 }
 
 TEST(UNISTD_TEST, _POSIX_constants) {
diff --git a/tools/update_notice.sh b/tools/update_notice.sh
index c45311a..69e090c 100755
--- a/tools/update_notice.sh
+++ b/tools/update_notice.sh
@@ -11,4 +11,4 @@
 python3 ./libc/tools/generate_notice.py linker > linker/NOTICE
 python3 ./libc/tools/generate_notice.py tests > tests/NOTICE
 python3 ./libc/tools/generate_notice.py tools > tools/NOTICE
-git diff --exit-code HEAD libc/NOTICE
+git diff --exit-code HEAD */NOTICE