I am puzzled by enthusiasm for various species of memory tagging, such as sifive.com/blog/sifive-sh, dovermicrosystems.com/solutions/core, community.arm.com/developer/ip-p, which provide either coarse-grained or statistical protection when there's CHERI, which is fine-grained and exact. 1/2
Conversation
Replying to
Also, if memory serves correct, CHERI does not protect against data-only use after free attacks. So not exactly exact ;)

