diff --git a/tests/libs/cfi_test_lib.cpp b/tests/libs/cfi_test_lib.cpp
index 9f456d3..6f551c5 100644
--- a/tests/libs/cfi_test_lib.cpp
+++ b/tests/libs/cfi_test_lib.cpp
@@ -67,12 +67,9 @@
   void check_cfi_self() {
     g_last_type_id = 0;
     assert(&__cfi_slowpath);
-    // CFI check for an invalid address. Normally, this would kill the process by routing the call
-    // back to the calling module's __cfi_check, which does the right thing based on
-    // -fsanitize-recover / -fsanitize-trap. But this module has custom __cfi_check that does not do
-    // any of that, so the result looks like a passing check.
-    int zz;
-    __cfi_slowpath(13, static_cast<void*>(&zz));
+    // CFI check for an address inside this DSO. This goes to the current module's __cfi_check,
+    // which updates g_last_type_id.
+    __cfi_slowpath(13, static_cast<void*>(&g_last_type_id));
     assert(g_last_type_id == 13);
     // CFI check for a libc function. This never goes into this module's __cfi_check, and must pass.
     __cfi_slowpath(14, reinterpret_cast<void*>(&exit));