--- libmalloc/libmalloc-657.80.3/tests/threaded_stress.c
+++ libmalloc/libmalloc-792.80.2/tests/threaded_stress.c
@@ -20,7 +20,7 @@
 // These tests are based on perf_contended_malloc_free, but intended as
 // functional stress tests rather than performance tests.
 
-T_GLOBAL_META(T_META_TAG_XZONE);
+T_GLOBAL_META(T_META_TAG_ALL_ALLOCATORS, T_META_TAG_VM_NOT_PREFERRED);
 
 // move the darwintest assertion code out of the straight line execution path
 // since it is has non-trivial overhead and codegen impact even if the assertion
@@ -263,11 +263,15 @@
 			if (!remaining_frees--) break;
 			alloc = NULL;
 		}
+
+		// Size without taking ownership to allow another thread to race to free
+		(void)malloc_size(allocations[pos % live_allocations]);
+
 		alloc = atomic_exchange(
 				(_Atomic(void *) *)&allocations[(pos++)%live_allocations],
 				alloc);
 		if (alloc) {
-			// Size once while allocated
+			// Size again while definitely allocated
 			(void)malloc_size(alloc);
 
 			dummy = busy(second);
@@ -275,7 +279,7 @@
 
 			// Calling malloc_size on free pointers isn't safe in exclaves
 #if !MALLOC_TARGET_EXCLAVES
-			// Try again while (possibly) free
+			// Size again while probably free, but possibly re-allocated
 			malloc_size(alloc);
 #endif // !MALLOC_TARGET_EXCLAVES
 		}
@@ -286,7 +290,21 @@
 }
 
 T_DECL(threaded_stress_malloc_size_tiny,
-		"multi-threaded stress test for tiny malloc_size")
+		"multi-threaded stress test for tiny malloc_size",
+		T_META_ENVVAR("MallocNanoZone=0"))
+{
+	uint64_t iterations = 2000000ull;
+#if TARGET_OS_TV || TARGET_OS_WATCH
+	iterations = 200000ull;
+#endif // TARGET_OS_TV || TARGET_OS_WATCH
+
+	malloc_threaded_stress(false, 16, 256, 16, 2048,
+			iterations, malloc_size_stress_thread);
+}
+
+T_DECL(threaded_stress_malloc_size_nano,
+		"multi-threaded stress test for nano malloc_size",
+		T_META_ENVVAR("MallocNanoZone=1"))
 {
 	uint64_t iterations = 2000000ull;
 #if TARGET_OS_TV || TARGET_OS_WATCH