diff --git a/libc/bionic/heap_tagging.cpp b/libc/bionic/heap_tagging.cpp
index 9805fbd..ffbabb9 100644
--- a/libc/bionic/heap_tagging.cpp
+++ b/libc/bionic/heap_tagging.cpp
@@ -52,6 +52,9 @@
         globals->heap_pointer_tag = (reinterpret_cast<uintptr_t>(POINTER_TAG) << TAG_SHIFT) |
                                     (0xffull << CHECK_SHIFT) | (0xffull << UNTAG_SHIFT);
       });
+#if defined(USE_SCUDO)
+      scudo_malloc_disable_memory_tagging();
+#endif  // USE_SCUDO
       break;
 #if defined(USE_SCUDO)
     case M_HEAP_TAGGING_LEVEL_SYNC:
diff --git a/libc/bionic/libc_init_static.cpp b/libc/bionic/libc_init_static.cpp
index 3705606..2e4ee11 100644
--- a/libc/bionic/libc_init_static.cpp
+++ b/libc/bionic/libc_init_static.cpp
@@ -39,15 +39,17 @@
 #include "libc_init_common.h"
 #include "pthread_internal.h"
 
+#include "platform/bionic/macros.h"
+#include "platform/bionic/mte.h"
 #include "platform/bionic/page.h"
+#include "private/KernelArgumentBlock.h"
+#include "private/bionic_asm.h"
+#include "private/bionic_asm_note.h"
 #include "private/bionic_call_ifunc_resolver.h"
 #include "private/bionic_elf_tls.h"
 #include "private/bionic_globals.h"
-#include "platform/bionic/macros.h"
-#include "private/bionic_asm.h"
-#include "private/bionic_asm_note.h"
 #include "private/bionic_tls.h"
-#include "private/KernelArgumentBlock.h"
+#include "sys/system_properties.h"
 
 #if __has_feature(hwaddress_sanitizer)
 #include <sanitizer/hwasan_interface.h>
@@ -61,6 +63,7 @@
 #endif
 
 extern "C" int __cxa_atexit(void (*)(void *), void *, void *);
+extern "C" const char* __gnu_basename(const char* path);
 
 static void call_array(init_func_t** list, int argc, char* argv[], char* envp[]) {
   // First element is -1, list is null-terminated
@@ -160,6 +163,30 @@
   layout.finish_layout();
 }
 
+// Get the presiding config string, in the following order of priority:
+//   1. Environment variables.
+//   2. System properties, in the order they're specified in sys_prop_names.
+// If neither of these options are specified, this function returns false.
+// Otherwise, it returns true, and the presiding options string is written to
+// the `options` buffer of size `size`. If this function returns true, `options`
+// is guaranteed to be null-terminated. `options_size` should be at least
+// PROP_VALUE_MAX.
+bool get_config_from_env_or_sysprops(const char* env_var_name, const char* const* sys_prop_names,
+                                     size_t sys_prop_names_size, char* options,
+                                     size_t options_size) {
+  const char* env = getenv(env_var_name);
+  if (env && *env != '\0') {
+    strncpy(options, env, options_size);
+    options[options_size - 1] = '\0'; // Ensure null-termination.
+    return true;
+  }
+
+  for (size_t i = 0; i < sys_prop_names_size; ++i) {
+    if (__system_property_get(sys_prop_names[i], options) && *options != '\0') return true;
+  }
+  return false;
+}
+
 #ifdef __aarch64__
 static bool __read_memtag_note(const ElfW(Nhdr)* note, const char* name, const char* desc,
                                unsigned* result) {
@@ -204,42 +231,94 @@
   return 0;
 }
 
+// Returns true if there's an environment setting (either sysprop or env var)
+// that should overwrite the ELF note, and places the equivalent heap tagging
+// level into *level.
+static bool get_environment_memtag_setting(HeapTaggingLevel* level) {
+  static const char kMemtagPrognameSyspropPrefix[] = "arm64.memtag.process.";
+
+  const char* progname = __libc_shared_globals()->init_progname;
+  if (progname == nullptr) return false;
+
+  const char* basename = __gnu_basename(progname);
+
+  static constexpr size_t kOptionsSize = PROP_VALUE_MAX;
+  char options_str[kOptionsSize];
+  size_t sysprop_size = strlen(basename) + strlen(kMemtagPrognameSyspropPrefix) + 1;
+  char* sysprop_name = static_cast<char*>(alloca(sysprop_size));
+
+  async_safe_format_buffer(sysprop_name, sysprop_size, "%s%s", kMemtagPrognameSyspropPrefix,
+                           basename);
+
+  if (!get_config_from_env_or_sysprops("MEMTAG_OPTIONS", &sysprop_name,
+                                       /* sys_prop_names_size */ 1, options_str, kOptionsSize)) {
+    return false;
+  }
+
+  if (strcmp("sync", options_str) == 0) {
+    *level = M_HEAP_TAGGING_LEVEL_SYNC;
+  } else if (strcmp("async", options_str) == 0) {
+    *level = M_HEAP_TAGGING_LEVEL_ASYNC;
+  } else if (strcmp("off", options_str) == 0) {
+    *level = M_HEAP_TAGGING_LEVEL_TBI;
+  } else {
+    async_safe_format_log(
+        ANDROID_LOG_ERROR, "libc",
+        "unrecognized memtag level: \"%s\" (options are \"sync\", \"async\", or \"off\").",
+        options_str);
+    return false;
+  }
+
+  return true;
+}
+
+// Returns the initial heap tagging level. Note: This function will never return
+// M_HEAP_TAGGING_LEVEL_NONE, if MTE isn't enabled for this process we enable
+// M_HEAP_TAGGING_LEVEL_TBI.
+static HeapTaggingLevel __get_heap_tagging_level(const void* phdr_start, size_t phdr_ct,
+                                                 uintptr_t load_bias) {
+  HeapTaggingLevel level;
+  if (get_environment_memtag_setting(&level)) return level;
+
+  unsigned note_val =
+      __get_memtag_note(reinterpret_cast<const ElfW(Phdr)*>(phdr_start), phdr_ct, load_bias);
+  if (note_val & ~(NT_MEMTAG_LEVEL_MASK | NT_MEMTAG_HEAP)) {
+    async_safe_fatal("unrecognized android.memtag note: desc = %d", note_val);
+  }
+
+  if (!(note_val & NT_MEMTAG_HEAP)) return M_HEAP_TAGGING_LEVEL_TBI;
+
+  unsigned memtag_level = note_val & NT_MEMTAG_LEVEL_MASK;
+  switch (memtag_level) {
+    case NT_MEMTAG_LEVEL_ASYNC:
+      return M_HEAP_TAGGING_LEVEL_ASYNC;
+    case NT_MEMTAG_LEVEL_DEFAULT:
+    case NT_MEMTAG_LEVEL_SYNC:
+      return M_HEAP_TAGGING_LEVEL_SYNC;
+    default:
+      async_safe_fatal("unrecognized android.memtag note: level = %d", memtag_level);
+  }
+}
+
 // Figure out the desired memory tagging mode (sync/async, heap/globals/stack) for this executable.
 // This function is called from the linker before the main executable is relocated.
 __attribute__((no_sanitize("hwaddress", "memtag"))) void __libc_init_mte(const void* phdr_start,
                                                                          size_t phdr_ct,
                                                                          uintptr_t load_bias) {
-  unsigned v =
-      __get_memtag_note(reinterpret_cast<const ElfW(Phdr)*>(phdr_start), phdr_ct, load_bias);
+  HeapTaggingLevel level = __get_heap_tagging_level(phdr_start, phdr_ct, load_bias);
 
-  if (v & ~(NT_MEMTAG_LEVEL_MASK | NT_MEMTAG_HEAP)) {
-    async_safe_fatal("unrecognized android.memtag note: desc = %d", v);
-  }
+  if (level == M_HEAP_TAGGING_LEVEL_SYNC || level == M_HEAP_TAGGING_LEVEL_ASYNC) {
+    unsigned long prctl_arg = PR_TAGGED_ADDR_ENABLE | PR_MTE_TAG_SET_NONZERO;
+    prctl_arg |= (level == M_HEAP_TAGGING_LEVEL_SYNC) ? PR_MTE_TCF_SYNC : PR_MTE_TCF_ASYNC;
 
-  if (v & NT_MEMTAG_HEAP) {
-    unsigned memtag_level = v & NT_MEMTAG_LEVEL_MASK;
-    unsigned long arg = PR_TAGGED_ADDR_ENABLE | (0xfffe << PR_MTE_TAG_SHIFT);
-    HeapTaggingLevel level;
-    switch (memtag_level) {
-      case NT_MEMTAG_LEVEL_ASYNC:
-        arg |= PR_MTE_TCF_ASYNC;
-        level = M_HEAP_TAGGING_LEVEL_ASYNC;
-        break;
-      case NT_MEMTAG_LEVEL_DEFAULT:
-      case NT_MEMTAG_LEVEL_SYNC:
-        arg |= PR_MTE_TCF_SYNC;
-        level = M_HEAP_TAGGING_LEVEL_SYNC;
-        break;
-      default:
-        async_safe_fatal("unrecognized android.memtag note: level = %d", memtag_level);
-    }
-
-    if (prctl(PR_SET_TAGGED_ADDR_CTRL, arg, 0, 0, 0) == 0) {
+    if (prctl(PR_SET_TAGGED_ADDR_CTRL, prctl_arg, 0, 0, 0) == 0) {
       __libc_shared_globals()->initial_heap_tagging_level = level;
       return;
     }
   }
 
+  // MTE was either not enabled, or wasn't supported on this device. Try and use
+  // TBI.
   if (prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0) == 0) {
     __libc_shared_globals()->initial_heap_tagging_level = M_HEAP_TAGGING_LEVEL_TBI;
   }
diff --git a/libc/platform/bionic/mte.h b/libc/platform/bionic/mte.h
index b11b1a6..73cd821 100644
--- a/libc/platform/bionic/mte.h
+++ b/libc/platform/bionic/mte.h
@@ -29,6 +29,13 @@
 #pragma once
 
 #include <sys/auxv.h>
+#include <sys/prctl.h>
+
+// Note: Most PR_MTE_* constants come from the upstream kernel. This tag mask
+// allows for the hardware to provision any nonzero tag. Zero tags are reserved
+// for scudo to use for the chunk headers in order to prevent linear heap
+// overflow/underflow.
+#define PR_MTE_TAG_SET_NONZERO (0xfffeUL << PR_MTE_TAG_SHIFT)
 
 inline bool mte_supported() {
 #if defined(__aarch64__)
diff --git a/linker/dlfcn.cpp b/linker/dlfcn.cpp
index 772e7b8..af05027 100644
--- a/linker/dlfcn.cpp
+++ b/linker/dlfcn.cpp
@@ -328,7 +328,7 @@
     __libdl_info->ref_count_ = 1;
     __libdl_info->strtab_size_ = linker_si.strtab_size_;
     __libdl_info->local_group_root_ = __libdl_info;
-    __libdl_info->soname_ = linker_si.soname_.c_str();
+    __libdl_info->soname_ = linker_si.soname_;
     __libdl_info->target_sdk_version_ = __ANDROID_API__;
     __libdl_info->generate_handle();
 #if defined(__work_around_b_24465209__)
diff --git a/linker/linker.cpp b/linker/linker.cpp
index 77824f6..c240c56 100644
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -3193,26 +3193,27 @@
     return false;
   }
 
-  // second pass - parse entries relying on strtab
-  for (ElfW(Dyn)* d = dynamic; d->d_tag != DT_NULL; ++d) {
-    switch (d->d_tag) {
-      case DT_SONAME:
-        set_soname(get_string(d->d_un.d_val));
-        break;
-      case DT_RUNPATH:
-        set_dt_runpath(get_string(d->d_un.d_val));
-        break;
+  // Second pass - parse entries relying on strtab. Skip this while relocating the linker so as to
+  // avoid doing heap allocations until later in the linker's initialization.
+  if (!relocating_linker) {
+    for (ElfW(Dyn)* d = dynamic; d->d_tag != DT_NULL; ++d) {
+      switch (d->d_tag) {
+        case DT_SONAME:
+          set_soname(get_string(d->d_un.d_val));
+          break;
+        case DT_RUNPATH:
+          set_dt_runpath(get_string(d->d_un.d_val));
+          break;
+      }
     }
   }
 
-  // Before M release linker was using basename in place of soname.
-  // In the case when dt_soname is absent some apps stop working
-  // because they can't find dt_needed library by soname.
-  // This workaround should keep them working. (Applies only
-  // for apps targeting sdk version < M.) Make an exception for
-  // the main executable and linker; they do not need to have dt_soname.
-  // TODO: >= O the linker doesn't need this workaround.
-  if (soname_.empty() && this != solist_get_somain() && (flags_ & FLAG_LINKER) == 0 &&
+  // Before M release, linker was using basename in place of soname. In the case when DT_SONAME is
+  // absent some apps stop working because they can't find DT_NEEDED library by soname. This
+  // workaround should keep them working. (Applies only for apps targeting sdk version < M.) Make
+  // an exception for the main executable, which does not need to have DT_SONAME. The linker has an
+  // DT_SONAME but the soname_ field is initialized later on.
+  if (soname_.empty() && this != solist_get_somain() && !relocating_linker &&
       get_application_target_sdk_version() < 23) {
     soname_ = basename(realpath_.c_str());
     DL_WARN_documented_change(23, "missing-soname-enforced-for-api-level-23",
diff --git a/linker/linker_main.cpp b/linker/linker_main.cpp
index 59e8036..0b501a7 100644
--- a/linker/linker_main.cpp
+++ b/linker/linker_main.cpp
@@ -725,6 +725,13 @@
   // Initialize the linker's own global variables
   tmp_linker_so.call_constructors();
 
+  // Setting the linker soinfo's soname can allocate heap memory, so delay it until here.
+  for (const ElfW(Dyn)* d = tmp_linker_so.dynamic; d->d_tag != DT_NULL; ++d) {
+    if (d->d_tag == DT_SONAME) {
+      tmp_linker_so.set_soname(tmp_linker_so.get_string(d->d_un.d_val));
+    }
+  }
+
   // When the linker is run directly rather than acting as PT_INTERP, parse
   // arguments and determine the executable to load. When it's instead acting
   // as PT_INTERP, AT_ENTRY will refer to the loaded executable rather than the
diff --git a/tests/Android.bp b/tests/Android.bp
index e7118b3..678eae8 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -845,66 +845,95 @@
         "elftls_dlopen_ie_error_helper",
         "exec_linker_helper",
         "exec_linker_helper_lib",
-        "libtest_dt_runpath_a",
-        "libtest_dt_runpath_b",
-        "libtest_dt_runpath_c",
-        "libtest_dt_runpath_x",
-        "libtest_dt_runpath_y",
+        "heap_tagging_async_helper",
+        "heap_tagging_disabled_helper",
+        "heap_tagging_static_async_helper",
+        "heap_tagging_static_disabled_helper",
+        "heap_tagging_static_sync_helper",
+        "heap_tagging_sync_helper",
+        "ld_config_test_helper",
+        "ld_config_test_helper_lib1",
+        "ld_config_test_helper_lib2",
+        "ld_config_test_helper_lib3",
+        "ld_preload_test_helper",
+        "ld_preload_test_helper_lib1",
+        "ld_preload_test_helper_lib2",
         "libatest_simple_zip",
         "libcfi-test",
         "libcfi-test-bad",
+        "libdl_preempt_test_1",
+        "libdl_preempt_test_2",
+        "libdl_test_df_1_global",
+        "libdlext_test",
         "libdlext_test_different_soname",
         "libdlext_test_fd",
         "libdlext_test_norelro",
         "libdlext_test_recursive",
         "libdlext_test_runpath_zip_zipaligned",
-        "libdlext_test",
         "libdlext_test_zip",
         "libdlext_test_zip_zipaligned",
-        "libdl_preempt_test_1",
-        "libdl_preempt_test_2",
-        "libdl_test_df_1_global",
         "libgnu-hash-table-library",
-        "librelocations-ANDROID_RELR",
+        "libns_hidden_child_app",
+        "libns_hidden_child_global",
+        "libns_hidden_child_internal",
+        "libns_hidden_child_public",
+        "libnstest_dlopened",
+        "libnstest_ns_a_public1",
+        "libnstest_ns_a_public1_internal",
+        "libnstest_ns_b_public2",
+        "libnstest_ns_b_public3",
+        "libnstest_private",
+        "libnstest_private_external",
+        "libnstest_public",
+        "libnstest_public_internal",
+        "libnstest_root",
+        "libnstest_root_not_isolated",
         "librelocations-ANDROID_REL",
+        "librelocations-ANDROID_RELR",
         "librelocations-RELR",
         "librelocations-fat",
+        "libsegment_gap_inner",
+        "libsegment_gap_outer",
         "libsysv-hash-table-library",
-        "libtestshared",
         "libtest_atexit",
+        "libtest_check_order_dlsym",
         "libtest_check_order_dlsym_1_left",
         "libtest_check_order_dlsym_2_right",
         "libtest_check_order_dlsym_3_c",
         "libtest_check_order_dlsym_a",
         "libtest_check_order_dlsym_b",
         "libtest_check_order_dlsym_d",
-        "libtest_check_order_dlsym",
+        "libtest_check_order_reloc_root",
         "libtest_check_order_reloc_root_1",
         "libtest_check_order_reloc_root_2",
-        "libtest_check_order_reloc_root",
+        "libtest_check_order_reloc_siblings",
         "libtest_check_order_reloc_siblings_1",
         "libtest_check_order_reloc_siblings_2",
         "libtest_check_order_reloc_siblings_3",
         "libtest_check_order_reloc_siblings_a",
         "libtest_check_order_reloc_siblings_b",
+        "libtest_check_order_reloc_siblings_c",
         "libtest_check_order_reloc_siblings_c_1",
         "libtest_check_order_reloc_siblings_c_2",
-        "libtest_check_order_reloc_siblings_c",
         "libtest_check_order_reloc_siblings_d",
         "libtest_check_order_reloc_siblings_e",
         "libtest_check_order_reloc_siblings_f",
-        "libtest_check_order_reloc_siblings",
         "libtest_check_rtld_next_from_library",
         "libtest_dlopen_df_1_global",
-        "libtest_dlopen_from_ctor_main",
         "libtest_dlopen_from_ctor",
+        "libtest_dlopen_from_ctor_main",
         "libtest_dlopen_weak_undefined_func",
         "libtest_dlsym_df_1_global",
+        "libtest_dlsym_from_this",
         "libtest_dlsym_from_this_child",
         "libtest_dlsym_from_this_grandchild",
-        "libtest_dlsym_from_this",
         "libtest_dlsym_weak_func",
+        "libtest_dt_runpath_a",
+        "libtest_dt_runpath_b",
+        "libtest_dt_runpath_c",
         "libtest_dt_runpath_d",
+        "libtest_dt_runpath_x",
+        "libtest_dt_runpath_y",
         "libtest_elftls_dynamic",
         "libtest_elftls_dynamic_filler_1",
         "libtest_elftls_dynamic_filler_2",
@@ -913,83 +942,60 @@
         "libtest_elftls_shared_var_ie",
         "libtest_elftls_tprel",
         "libtest_empty",
-        "libtest_ifunc_variable_impl",
-        "libtest_ifunc_variable",
         "libtest_ifunc",
+        "libtest_ifunc_variable",
+        "libtest_ifunc_variable_impl",
+        "libtest_indirect_thread_local_dtor",
         "libtest_init_fini_order_child",
         "libtest_init_fini_order_grand_child",
-        "libtest_init_fini_order_root2",
         "libtest_init_fini_order_root",
-        "libtest_missing_symbol_child_public",
-        "libtest_missing_symbol_child_private",
-        "libtest_missing_symbol_root",
+        "libtest_init_fini_order_root2",
+        "libtest_invalid-empty_shdr_table",
+        "libtest_invalid-rw_load_segment",
+        "libtest_invalid-textrels",
+        "libtest_invalid-textrels2",
+        "libtest_invalid-unaligned_shdr_offset",
+        "libtest_invalid-zero_shdr_table_content",
+        "libtest_invalid-zero_shdr_table_offset",
+        "libtest_invalid-zero_shentsize",
+        "libtest_invalid-zero_shstrndx",
         "libtest_missing_symbol",
+        "libtest_missing_symbol_child_private",
+        "libtest_missing_symbol_child_public",
+        "libtest_missing_symbol_root",
         "libtest_nodelete_1",
         "libtest_nodelete_2",
         "libtest_nodelete_dt_flags_1",
         "libtest_pthread_atfork",
+        "libtest_relo_check_dt_needed_order",
         "libtest_relo_check_dt_needed_order_1",
         "libtest_relo_check_dt_needed_order_2",
-        "libtest_relo_check_dt_needed_order",
         "libtest_simple",
+        "libtest_thread_local_dtor",
+        "libtest_thread_local_dtor2",
         "libtest_two_parents_child",
         "libtest_two_parents_parent1",
         "libtest_two_parents_parent2",
         "libtest_versioned_lib",
         "libtest_versioned_libv1",
         "libtest_versioned_libv2",
-        "libtest_versioned_otherlib_empty",
         "libtest_versioned_otherlib",
+        "libtest_versioned_otherlib_empty",
         "libtest_versioned_uselibv1",
-        "libtest_versioned_uselibv2_other",
         "libtest_versioned_uselibv2",
+        "libtest_versioned_uselibv2_other",
         "libtest_versioned_uselibv3_other",
+        "libtest_with_dependency",
+        "libtest_with_dependency_loop",
         "libtest_with_dependency_loop_a",
         "libtest_with_dependency_loop_b",
         "libtest_with_dependency_loop_c",
-        "libtest_with_dependency_loop",
-        "libtest_with_dependency",
-        "libtest_indirect_thread_local_dtor",
-        "libtest_invalid-empty_shdr_table",
-        "libtest_invalid-rw_load_segment",
-        "libtest_invalid-unaligned_shdr_offset",
-        "libtest_invalid-zero_shdr_table_content",
-        "libtest_invalid-zero_shdr_table_offset",
-        "libtest_invalid-zero_shentsize",
-        "libtest_invalid-zero_shstrndx",
-        "libtest_invalid-textrels",
-        "libtest_invalid-textrels2",
-        "libtest_thread_local_dtor",
-        "libtest_thread_local_dtor2",
+        "libtestshared",
+        "ns_hidden_child_helper",
         "preinit_getauxval_test_helper",
         "preinit_syscall_test_helper",
-        "libnstest_private_external",
-        "libnstest_dlopened",
-        "libnstest_private",
-        "libnstest_root_not_isolated",
-        "libnstest_root",
-        "libnstest_public",
-        "libnstest_public_internal",
-        "libnstest_ns_a_public1",
-        "libnstest_ns_a_public1_internal",
-        "libnstest_ns_b_public2",
-        "libnstest_ns_b_public3",
-        "ns_hidden_child_helper",
-        "libns_hidden_child_global",
-        "libns_hidden_child_internal",
-        "libns_hidden_child_public",
-        "libns_hidden_child_app",
-        "libsegment_gap_inner",
-        "libsegment_gap_outer",
-        "ld_preload_test_helper",
-        "ld_preload_test_helper_lib1",
-        "ld_preload_test_helper_lib2",
-        "ld_config_test_helper",
-        "ld_config_test_helper_lib1",
-        "ld_config_test_helper_lib2",
-        "ld_config_test_helper_lib3",
-        "tls_properties_helper",
         "thread_exit_cb_helper",
+        "tls_properties_helper",
     ],
 }
 
diff --git a/tests/heap_tagging_level_test.cpp b/tests/heap_tagging_level_test.cpp
index 4f8f036..fd3b786 100644
--- a/tests/heap_tagging_level_test.cpp
+++ b/tests/heap_tagging_level_test.cpp
@@ -18,6 +18,7 @@
 #include <sys/prctl.h>
 
 #if defined(__BIONIC__)
+#include "gtest_globals.h"
 #include "platform/bionic/malloc.h"
 #include "platform/bionic/mte.h"
 #include "utils.h"
@@ -90,7 +91,8 @@
 
   std::unique_ptr<int[]> p = std::make_unique<int[]>(4);
 
-  // First, check that memory tagging is enabled and the default tag checking level is async.
+  // First, check that memory tagging is enabled and the default tag checking level is sync.
+  // cc_test targets get sync MTE by default.
   // We assume that scudo is used on all MTE enabled hardware; scudo inserts a header with a
   // mismatching tag before each allocation.
   EXPECT_EXIT(
@@ -98,15 +100,15 @@
         ScopedSignalHandler ssh(SIGSEGV, ExitWithSiCode, SA_SIGINFO);
         p[-1] = 42;
       },
-      testing::ExitedWithCode(SEGV_MTEAERR), "");
+      testing::ExitedWithCode(SEGV_MTESERR), "");
 
-  EXPECT_TRUE(SetHeapTaggingLevel(M_HEAP_TAGGING_LEVEL_SYNC));
+  EXPECT_TRUE(SetHeapTaggingLevel(M_HEAP_TAGGING_LEVEL_ASYNC));
   EXPECT_EXIT(
       {
         ScopedSignalHandler ssh(SIGSEGV, ExitWithSiCode, SA_SIGINFO);
         p[-1] = 42;
       },
-      testing::ExitedWithCode(SEGV_MTESERR), "");
+      testing::ExitedWithCode(SEGV_MTEAERR), "");
 
   EXPECT_TRUE(SetHeapTaggingLevel(M_HEAP_TAGGING_LEVEL_NONE));
   volatile int oob ATTRIBUTE_UNUSED = p[-1];
@@ -177,3 +179,34 @@
   GTEST_SKIP() << "bionic/arm64 only";
 #endif
 }
+
+enum class MemtagNote { NONE, ASYNC, SYNC };
+class MemtagNoteTest : public testing::TestWithParam<std::tuple<MemtagNote, bool>> {};
+
+TEST_P(MemtagNoteTest, SEGV) {
+#if defined(__BIONIC__) && defined(__aarch64__)
+  if (!(getauxval(AT_HWCAP2) & HWCAP2_MTE)) {
+    GTEST_SKIP() << "requires MTE support";
+  }
+
+  const char* kNoteSuffix[] = {"disabled", "async", "sync"};
+  const char* kExpectedOutput[] = {"normal exit\n", "SEGV_MTEAERR\n", "SEGV_MTESERR\n"};
+
+  MemtagNote note = std::get<0>(GetParam());
+  bool isStatic = std::get<1>(GetParam());
+  std::string helper_base = std::string("heap_tagging_") + (isStatic ? "static_" : "") +
+                            kNoteSuffix[static_cast<int>(note)] + "_helper";
+  fprintf(stderr, "=== %s\n", helper_base.c_str());
+  std::string helper = GetTestlibRoot() + "/" + helper_base + "/" + helper_base;
+  chmod(helper.c_str(), 0755);
+  ExecTestHelper eth;
+  eth.SetArgs({helper.c_str(), nullptr});
+  eth.Run([&]() { execve(helper.c_str(), eth.GetArgs(), eth.GetEnv()); }, 0,
+          kExpectedOutput[static_cast<int>(note)]);
+#endif
+}
+
+INSTANTIATE_TEST_SUITE_P(, MemtagNoteTest,
+                         testing::Combine(testing::Values(MemtagNote::NONE, MemtagNote::ASYNC,
+                                                          MemtagNote::SYNC),
+                                          testing::Bool()));
diff --git a/tests/libs/Android.bp b/tests/libs/Android.bp
index 4b86faf..385d120 100644
--- a/tests/libs/Android.bp
+++ b/tests/libs/Android.bp
@@ -1579,3 +1579,85 @@
     defaults: ["bionic_testlib_defaults"],
     srcs: ["relocations.cpp"],
 }
+
+cc_defaults {
+  name: "bionic_targets_only",
+  enabled: false,
+  target: {
+     android: {
+       enabled: true,
+     },
+     linux_bionic: {
+       enabled: true,
+     },
+   },
+}
+
+cc_test {
+   name: "heap_tagging_sync_helper",
+   defaults: ["bionic_testlib_defaults", "bionic_targets_only"],
+   srcs: ["heap_tagging_helper.cpp"],
+   sanitize: {
+     memtag_heap: true,
+     diag: {
+       memtag_heap: true,
+     },
+   },
+}
+
+cc_test {
+   name: "heap_tagging_async_helper",
+   defaults: ["bionic_testlib_defaults", "bionic_targets_only"],
+   srcs: ["heap_tagging_helper.cpp"],
+   sanitize: {
+     memtag_heap: true,
+     diag: {
+       memtag_heap: false,
+     },
+   },
+}
+
+cc_test {
+   name: "heap_tagging_disabled_helper",
+   defaults: ["bionic_testlib_defaults", "bionic_targets_only"],
+   srcs: ["heap_tagging_helper.cpp"],
+   sanitize: {
+     memtag_heap: false,
+   },
+}
+
+cc_test {
+   name: "heap_tagging_static_sync_helper",
+   defaults: ["bionic_testlib_defaults", "bionic_targets_only"],
+   srcs: ["heap_tagging_helper.cpp"],
+   static_executable: true,
+   sanitize: {
+     memtag_heap: true,
+     diag: {
+       memtag_heap: true,
+     },
+   },
+}
+
+cc_test {
+   name: "heap_tagging_static_async_helper",
+   defaults: ["bionic_testlib_defaults", "bionic_targets_only"],
+   srcs: ["heap_tagging_helper.cpp"],
+   static_executable: true,
+   sanitize: {
+     memtag_heap: true,
+     diag: {
+       memtag_heap: false,
+     },
+   },
+}
+
+cc_test {
+   name: "heap_tagging_static_disabled_helper",
+   defaults: ["bionic_testlib_defaults", "bionic_targets_only"],
+   srcs: ["heap_tagging_helper.cpp"],
+   static_executable: true,
+   sanitize: {
+     memtag_heap: false,
+   },
+}
diff --git a/tests/libs/heap_tagging_helper.cpp b/tests/libs/heap_tagging_helper.cpp
new file mode 100644
index 0000000..1a970f2
--- /dev/null
+++ b/tests/libs/heap_tagging_helper.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <signal.h>
+#include <stdio.h>
+#include <sys/cdefs.h>
+#include <unistd.h>
+#include <memory>
+
+void action(int signo, siginfo_t* info __unused, void*) {
+#ifdef __ANDROID__
+  if (signo == 11 && info->si_code == SEGV_MTEAERR) {
+    fprintf(stderr, "SEGV_MTEAERR\n");
+    _exit(0);
+  }
+
+  if (signo == 11 && info->si_code == SEGV_MTESERR) {
+    fprintf(stderr, "SEGV_MTESERR\n");
+    _exit(0);
+  }
+#endif
+
+  fprintf(stderr, "signo %d\n", signo);
+  _exit(0);
+}
+
+__attribute__((optnone)) int main() {
+  struct sigaction sa = {};
+  sa.sa_sigaction = action;
+  sa.sa_flags = SA_SIGINFO;
+  sigaction(SIGSEGV, &sa, nullptr);
+
+  std::unique_ptr<int[]> p = std::make_unique<int[]>(4);
+  volatile int oob = p[-1];
+  (void)oob;
+
+  fprintf(stderr, "normal exit\n");
+  return 0;
+}