https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116481
--- Comment #10 from Richard Sandiford <rsandifo at gcc dot gnu.org> --- (In reply to Richard Sandiford from comment #9) > If the tag bit is dropped by going > out of bounds, that's a feature, not a bug, and would happen equally for > void*/char* arithmetic as for (u)intptr_t arithmetic. “out of bounds” here meaning “out of the representable bounds” of a capability (as distinct from “out of the object's bounds”, which is checked at dereference).