It should be possible to guarantee 100% detection of linear buffer overflows by giving adjacent objects distinct tags.
Related bug: https://bugzilla.kernel.org/show_bug.cgi?id=212177
For reference, this is how SCUDO does this: https://github.com/llvm/llvm-project/commit/b83417aa7e26ca76c433ec5befdecd5c571408a6