diff --git a/libc/Android.bp b/libc/Android.bp
index 57d4039..570e785 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -2523,6 +2523,9 @@
     // Mark this library as global so it overrides all the allocation
     // definitions properly.
     ldflags: ["-Wl,-z,global"],
+
+    // Like libc, disable native coverage for libc_scudo.
+    native_coverage: false,
 }
 
 subdirs = [
diff --git a/libc/bionic/scudo/Android.bp b/libc/bionic/scudo/Android.bp
index 8b518bb..9b77c06 100644
--- a/libc/bionic/scudo/Android.bp
+++ b/libc/bionic/scudo/Android.bp
@@ -57,4 +57,7 @@
             version_script: "exported64.map",
         },
     },
+
+    // Like libc, disable native coverage for libscudo_wrapper.
+    native_coverage: false,
 }
diff --git a/libc/include/bits/fortify/poll.h b/libc/include/bits/fortify/poll.h
index 718ee96..0d9b927 100644
--- a/libc/include/bits/fortify/poll.h
+++ b/libc/include/bits/fortify/poll.h
@@ -40,8 +40,7 @@
 __BIONIC_FORTIFY_INLINE
 int poll(struct pollfd* const fds __pass_object_size, nfds_t fd_count, int timeout)
     __overloadable
-    __clang_error_if(__bos(fds) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
-                       __bos(fds) < sizeof(*fds) * fd_count,
+    __clang_error_if(__bos_unevaluated_lt(__bos(fds), sizeof(*fds) * fd_count),
                      "in call to 'poll', fd_count is larger than the given buffer") {
   size_t bos_fds = __bos(fds);
 
@@ -54,8 +53,7 @@
 __BIONIC_FORTIFY_INLINE
 int ppoll(struct pollfd* const fds __pass_object_size, nfds_t fd_count, const struct timespec* timeout, const sigset_t* mask)
     __overloadable
-    __clang_error_if(__bos(fds) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
-                       __bos(fds) < sizeof(*fds) * fd_count,
+    __clang_error_if(__bos_unevaluated_lt(__bos(fds), sizeof(*fds) * fd_count),
                      "in call to 'ppoll', fd_count is larger than the given buffer") {
   size_t bos_fds = __bos(fds);
 
@@ -69,8 +67,7 @@
 __BIONIC_FORTIFY_INLINE
 int ppoll64(struct pollfd* const fds __pass_object_size, nfds_t fd_count, const struct timespec* timeout, const sigset64_t* mask)
     __overloadable
-    __clang_error_if(__bos(fds) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
-                       __bos(fds) < sizeof(*fds) * fd_count,
+    __clang_error_if(__bos_unevaluated_lt(__bos(fds), sizeof(*fds) * fd_count),
                      "in call to 'ppoll64', fd_count is larger than the given buffer") {
   size_t bos_fds = __bos(fds);
 
diff --git a/libc/include/bits/fortify/socket.h b/libc/include/bits/fortify/socket.h
index 3d070c5..35fad3d 100644
--- a/libc/include/bits/fortify/socket.h
+++ b/libc/include/bits/fortify/socket.h
@@ -37,18 +37,15 @@
 
 #if defined(__BIONIC_FORTIFY)
 
-#define __recvfrom_bad_size "'recvfrom' called with size bigger than buffer"
-#define __sendto_bad_size "'sendto' called with size bigger than buffer"
-
 #if __ANDROID_API__ >= __ANDROID_API_N__
 __BIONIC_FORTIFY_INLINE
 ssize_t recvfrom(int fd, void* const buf __pass_object_size0, size_t len, int flags, struct sockaddr* src_addr, socklen_t* addr_len)
     __overloadable
-    __clang_error_if(__bos(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos(buf) < len,
-                     __recvfrom_bad_size) {
+    __clang_error_if(__bos_unevaluated_lt(__bos0(buf), len),
+                     "'recvfrom' called with size bigger than buffer") {
   size_t bos = __bos0(buf);
 
-  if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) {
+  if (__bos_trivially_not_lt(bos, len)) {
     return __call_bypassing_fortify(recvfrom)(fd, buf, len, flags, src_addr, addr_len);
   }
   return __recvfrom_chk(fd, buf, len, bos, flags, src_addr, addr_len);
@@ -59,11 +56,11 @@
 __BIONIC_FORTIFY_INLINE
 ssize_t sendto(int fd, const void* const buf __pass_object_size0, size_t len, int flags, const struct sockaddr* dest_addr, socklen_t addr_len)
     __overloadable
-    __clang_error_if(__bos0(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos0(buf) < len,
-                     __sendto_bad_size) {
+    __clang_error_if(__bos_unevaluated_lt(__bos0(buf), len),
+                     "'sendto' called with size bigger than buffer") {
   size_t bos = __bos0(buf);
 
-  if (bos == __BIONIC_FORTIFY_UNKNOWN_SIZE) {
+  if (__bos_trivially_not_lt(bos, len)) {
     return __call_bypassing_fortify(sendto)(fd, buf, len, flags, dest_addr, addr_len);
   }
   return __sendto_chk(fd, buf, len, bos, flags, dest_addr, addr_len);
@@ -73,7 +70,7 @@
 __BIONIC_FORTIFY_INLINE
 ssize_t recv(int socket, void* const buf __pass_object_size0, size_t len, int flags)
     __overloadable
-    __clang_error_if(__bos0(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos0(buf) < len,
+    __clang_error_if(__bos_unevaluated_lt(__bos0(buf), len),
                      "'recv' called with size bigger than buffer") {
   return recvfrom(socket, buf, len, flags, NULL, 0);
 }
@@ -81,11 +78,9 @@
 __BIONIC_FORTIFY_INLINE
 ssize_t send(int socket, const void* const buf __pass_object_size0, size_t len, int flags)
     __overloadable
-    __clang_error_if(__bos0(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos0(buf) < len,
+    __clang_error_if(__bos_unevaluated_lt(__bos0(buf), len),
                      "'send' called with size bigger than buffer") {
   return sendto(socket, buf, len, flags, NULL, 0);
 }
 
-#undef __recvfrom_bad_size
-#undef __sendto_bad_size
 #endif /* __BIONIC_FORTIFY */
diff --git a/libc/include/bits/fortify/stat.h b/libc/include/bits/fortify/stat.h
index b248aca..30c8362 100644
--- a/libc/include/bits/fortify/stat.h
+++ b/libc/include/bits/fortify/stat.h
@@ -33,7 +33,6 @@
 mode_t __umask_chk(mode_t) __INTRODUCED_IN(18);
 
 #if defined(__BIONIC_FORTIFY)
-#define __umask_invalid_mode_str "'umask' called with invalid mode"
 
 #if __ANDROID_API__ >= __ANDROID_API_J_MR2__
 /* Abuse enable_if to make this an overload of umask. */
@@ -41,11 +40,9 @@
 mode_t umask(mode_t mode)
     __overloadable
     __enable_if(1, "")
-    __clang_error_if(mode & ~0777, __umask_invalid_mode_str) {
+    __clang_error_if(mode & ~0777, "'umask' called with invalid mode") {
   return __umask_chk(mode);
 }
 #endif /* __ANDROID_API__ >= __ANDROID_API_J_MR2__ */
 
-#undef __umask_invalid_mode_str
-
 #endif /* defined(__BIONIC_FORTIFY) */
diff --git a/libc/include/bits/fortify/stdio.h b/libc/include/bits/fortify/stdio.h
index 0b5700a..fc7d359 100644
--- a/libc/include/bits/fortify/stdio.h
+++ b/libc/include/bits/fortify/stdio.h
@@ -57,8 +57,7 @@
 __BIONIC_ERROR_FUNCTION_VISIBILITY
 int snprintf(char* dest, size_t size, const char* format)
     __overloadable
-    __enable_if(__bos(dest) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
-                    __bos(dest) < __builtin_strlen(format),
+    __enable_if(__bos_unevaluated_lt(__bos(dest), __builtin_strlen(format)),
                 "format string will always overflow destination buffer")
     __errorattr("format string will always overflow destination buffer");
 
@@ -75,8 +74,7 @@
 __BIONIC_ERROR_FUNCTION_VISIBILITY
 int sprintf(char* dest, const char* format)
     __overloadable
-    __enable_if(__bos(dest) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
-                __bos(dest) < __builtin_strlen(format),
+    __enable_if(__bos_unevaluated_lt(__bos(dest), __builtin_strlen(format)),
                 "format string will always overflow destination buffer")
     __errorattr("format string will always overflow destination buffer");
 
@@ -96,7 +94,7 @@
         __overloadable
         __clang_error_if(__unsafe_check_mul_overflow(size, count),
                          "in call to 'fread', size * count overflows")
-        __clang_error_if(__bos(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && size * count > __bos(buf),
+        __clang_error_if(__bos_unevaluated_lt(__bos0(buf), size * count),
                          "in call to 'fread', size * count is too large for the given buffer") {
     size_t bos = __bos0(buf);
 
@@ -111,7 +109,7 @@
         __overloadable
         __clang_error_if(__unsafe_check_mul_overflow(size, count),
                          "in call to 'fwrite', size * count overflows")
-        __clang_error_if(__bos(buf) != __BIONIC_FORTIFY_UNKNOWN_SIZE && size * count > __bos(buf),
+        __clang_error_if(__bos_unevaluated_lt(__bos0(buf), size * count),
                          "in call to 'fwrite', size * count is too large for the given buffer") {
     size_t bos = __bos0(buf);
 
@@ -128,7 +126,7 @@
 char* fgets(char* const __pass_object_size dest, int size, FILE* stream)
         __overloadable
         __clang_error_if(size < 0, "in call to 'fgets', size should not be negative")
-        __clang_error_if(size > __bos(dest),
+        __clang_error_if(__bos_unevaluated_lt(__bos(dest), size),
                          "in call to 'fgets', size is larger than the destination buffer") {
     size_t bos = __bos(dest);
 
diff --git a/libc/include/bits/fortify/stdlib.h b/libc/include/bits/fortify/stdlib.h
index d47c0b0..0bb3d0d 100644
--- a/libc/include/bits/fortify/stdlib.h
+++ b/libc/include/bits/fortify/stdlib.h
@@ -31,18 +31,16 @@
 #endif
 
 #if defined(__BIONIC_FORTIFY)
-#define __realpath_buf_too_small_str \
-    "'realpath' output parameter must be NULL or a pointer to a buffer with >= PATH_MAX bytes"
 
 /* PATH_MAX is unavailable without polluting the namespace, but it's always 4096 on Linux */
 #define __PATH_MAX 4096
 
 char* realpath(const char* path, char* resolved)
-        __clang_error_if(__bos(resolved) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
-                         __bos(resolved) < __PATH_MAX, __realpath_buf_too_small_str)
+        __clang_error_if(__bos_unevaluated_lt(__bos(resolved), __PATH_MAX),
+                         "'realpath' output parameter must be NULL or a pointer to a buffer "
+                         "with >= PATH_MAX bytes")
         __clang_error_if(!path, "'realpath': NULL path is never correct; flipped arguments?");
 /* No need for a definition; the only issues we can catch are at compile-time. */
 
 #undef __PATH_MAX
-#undef __realpath_buf_too_small_str
 #endif /* defined(__BIONIC_FORTIFY) */
diff --git a/libc/include/bits/fortify/string.h b/libc/include/bits/fortify/string.h
index 14bb133..426076e 100644
--- a/libc/include/bits/fortify/string.h
+++ b/libc/include/bits/fortify/string.h
@@ -44,17 +44,25 @@
 __BIONIC_FORTIFY_INLINE
 void* memcpy(void* const dst __pass_object_size0, const void* src, size_t copy_amount)
         __overloadable
-        __clang_error_if(__bos0(dst) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos0(dst) < copy_amount,
+        __clang_error_if(__bos_unevaluated_lt(__bos0(dst), copy_amount),
                          "'memcpy' called with size bigger than buffer") {
-    return __builtin___memcpy_chk(dst, src, copy_amount, __bos0(dst));
+    size_t bos_dst = __bos0(dst);
+    if (__bos_trivially_not_lt(bos_dst, copy_amount)) {
+        return __builtin_memcpy(dst, src, copy_amount);
+    }
+    return __builtin___memcpy_chk(dst, src, copy_amount, bos_dst);
 }
 
 __BIONIC_FORTIFY_INLINE
 void* memmove(void* const dst __pass_object_size0, const void* src, size_t len)
         __overloadable
-        __clang_error_if(__bos0(dst) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos0(dst) < len,
+        __clang_error_if(__bos_unevaluated_lt(__bos0(dst), len),
                          "'memmove' called with size bigger than buffer") {
-    return __builtin___memmove_chk(dst, src, len, __bos0(dst));
+    size_t bos_dst = __bos0(dst);
+    if (__bos_trivially_not_lt(bos_dst, len)) {
+        return __builtin_memmove(dst, src, len);
+    }
+    return __builtin___memmove_chk(dst, src, len, bos_dst);
 }
 #endif /* __ANDROID_API__ >= __ANDROID_API_J_MR1__ */
 
@@ -62,10 +70,13 @@
 __BIONIC_FORTIFY_INLINE
 char* stpcpy(char* const dst __pass_object_size, const char* src)
         __overloadable
-        __clang_error_if(__bos(dst) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
-                             __bos(dst) <= __builtin_strlen(src),
+        __clang_error_if(__bos_unevaluated_leq(__bos(dst), __builtin_strlen(src)),
                          "'stpcpy' called with string bigger than buffer") {
-    return __builtin___stpcpy_chk(dst, src, __bos(dst));
+    size_t bos_dst = __bos(dst);
+    if (__bos_trivially_not_leq(bos_dst, __builtin_strlen(src))) {
+        return __builtin_stpcpy(dst, src);
+    }
+    return __builtin___stpcpy_chk(dst, src, bos_dst);
 }
 #endif /* __ANDROID_API__ >= __ANDROID_API_L__ */
 
@@ -73,10 +84,13 @@
 __BIONIC_FORTIFY_INLINE
 char* strcpy(char* const dst __pass_object_size, const char* src)
         __overloadable
-        __clang_error_if(__bos(dst) != __BIONIC_FORTIFY_UNKNOWN_SIZE &&
-                             __bos(dst) <= __builtin_strlen(src),
+        __clang_error_if(__bos_unevaluated_leq(__bos(dst), __builtin_strlen(src)),
                          "'strcpy' called with string bigger than buffer") {
-    return __builtin___strcpy_chk(dst, src, __bos(dst));
+    size_t bos_dst = __bos(dst);
+    if (__bos_trivially_not_leq(bos_dst, __builtin_strlen(src))) {
+        return __builtin_strcpy(dst, src);
+    }
+    return __builtin___strcpy_chk(dst, src, bos_dst);
 }
 
 __BIONIC_FORTIFY_INLINE
@@ -92,11 +106,15 @@
 __BIONIC_FORTIFY_INLINE
 void* memset(void* const s __pass_object_size0, int c, size_t n)
         __overloadable
-        __clang_error_if(__bos0(s) != __BIONIC_FORTIFY_UNKNOWN_SIZE && __bos0(s) < n,
+        __clang_error_if(__bos_unevaluated_lt(__bos0(s), n),
                          "'memset' called with size bigger than buffer")
         /* If you're a user who wants this warning to go away: use `(&memset)(foo, bar, baz)`. */
         __clang_warning_if(c && !n, "'memset' will set 0 bytes; maybe the arguments got flipped?") {
-    return __builtin___memset_chk(s, c, n, __bos0(s));
+    size_t bos = __bos0(s);
+    if (__bos_trivially_not_lt(bos, n)) {
+        return __builtin_memset(s, c, n);
+    }
+    return __builtin___memset_chk(s, c, n, bos);
 }
 #endif /* __ANDROID_API__ >= __ANDROID_API_J_MR1__ */
 
diff --git a/libc/include/bits/fortify/unistd.h b/libc/include/bits/fortify/unistd.h
index a07907b..04c7495 100644
--- a/libc/include/bits/fortify/unistd.h
+++ b/libc/include/bits/fortify/unistd.h
@@ -63,7 +63,7 @@
     __clang_error_if((what) > SSIZE_MAX, "in call to '" #fn "', '" #what "' must be <= SSIZE_MAX")
 
 #define __error_if_overflows_objectsize(what, objsize, fn) \
-    __clang_error_if((objsize) != __BIONIC_FORTIFY_UNKNOWN_SIZE && (what) > (objsize), \
+    __clang_error_if(__bos_unevaluated_lt((objsize), (what)), \
                      "in call to '" #fn "', '" #what "' bytes overflows the given object")
 
 #if __ANDROID_API__ >= __ANDROID_API_N__
diff --git a/libc/include/sys/cdefs.h b/libc/include/sys/cdefs.h
index ca9374e..b4ae393 100644
--- a/libc/include/sys/cdefs.h
+++ b/libc/include/sys/cdefs.h
@@ -289,6 +289,21 @@
 #define __pass_object_size __pass_object_size_n(__bos_level)
 #define __pass_object_size0 __pass_object_size_n(0)
 
+/* Intended for use in unevaluated contexts, e.g. diagnose_if conditions. */
+#define __bos_unevaluated_lt(bos_val, val) \
+  ((bos_val) != __BIONIC_FORTIFY_UNKNOWN_SIZE && (bos_val) < (val))
+
+#define __bos_unevaluated_leq(bos_val, val) \
+  ((bos_val) != __BIONIC_FORTIFY_UNKNOWN_SIZE && (bos_val) <= (val))
+
+/* Intended for use in evaluated contexts. */
+#define __bos_dynamic_check_impl(bos_val, op, index) \
+  (bos_val == __BIONIC_FORTIFY_UNKNOWN_SIZE || (__builtin_constant_p(index) && bos_val op index))
+
+/* The names here are meant to match nicely with the __bos_unevaluated macros above. */
+#define __bos_trivially_not_lt(bos_val, index) __bos_dynamic_check_impl((bos_val), >=, (index))
+#define __bos_trivially_not_leq(bos_val, index) __bos_dynamic_check_impl((bos_val), >, (index))
+
 #if defined(__BIONIC_FORTIFY) || defined(__BIONIC_DECLARE_FORTIFY_HELPERS)
 #  define __BIONIC_INCLUDE_FORTIFY_HEADERS 1
 #endif
diff --git a/tests/libs/bionic_tests_zipalign.cpp b/tests/libs/bionic_tests_zipalign.cpp
index ec500d4..adb731f 100644
--- a/tests/libs/bionic_tests_zipalign.cpp
+++ b/tests/libs/bionic_tests_zipalign.cpp
@@ -37,7 +37,7 @@
   fprintf(stderr, "    The output zip file that will be created from the input file.\n");
 }
 
-using ZipData = std::pair<std::unique_ptr<ZipEntry>, std::unique_ptr<ZipString>>;
+using ZipData = std::pair<std::unique_ptr<ZipEntry>, std::string>;
 
 static bool GetEntries(ZipArchiveHandle handle, std::vector<ZipData>* entries) {
   void* cookie;
@@ -48,10 +48,9 @@
   }
 
   ZipEntry entry;
-  ZipString name;
+  std::string name;
   while ((return_value = Next(cookie, &entry, &name)) == 0) {
-    entries->emplace_back(std::make_pair(std::make_unique<ZipEntry>(entry),
-                                         std::make_unique<ZipString>(name)));
+    entries->emplace_back(std::make_pair(std::make_unique<ZipEntry>(entry), name));
   }
   if (return_value != -1) {
     fprintf(stderr, "Error while iterating over zip entries: %s\n", ErrorCodeString(return_value));
@@ -78,13 +77,12 @@
   int32_t error;
   for (auto& entry : entries) {
     ZipEntry* zip_entry = entry.first.get();
-    ZipString* zip_str = entry.second.get();
+    std::string& zip_name = entry.second;
 
     size_t flags = 0;
     if ((zip_entry->method & kCompressDeflated) != 0) {
       flags |= ZipWriter::kCompress;
     }
-    std::string zip_name(reinterpret_cast<const char*>(zip_str->name), zip_str->name_length);
     error = writer.StartAlignedEntry(zip_name.c_str(), flags, alignment);
     if (error != 0) {
       fprintf(stderr, "StartAlignedEntry failed: %s\n", ZipWriter::ErrorCodeString(error));