Could we also reserve a couple bytes at the beginning of the allocation to reliably work around this particular bug? I would think that +/& is trivial enough to not matter outside a really tight loop, but storing separately is fine too as far as I'm concerned.