--- libmalloc/libmalloc-715.100.22/tests/threaded_stress.c
+++ libmalloc/libmalloc-792.60.6/tests/threaded_stress.c
@@ -20,7 +20,7 @@
 // These tests are based on perf_contended_malloc_free, but intended as
 // functional stress tests rather than performance tests.
 
-T_GLOBAL_META(T_META_TAG_XZONE);
+T_GLOBAL_META(T_META_TAG_ALL_ALLOCATORS, T_META_TAG_VM_NOT_PREFERRED);
 
 // move the darwintest assertion code out of the straight line execution path
 // since it is has non-trivial overhead and codegen impact even if the assertion
@@ -263,11 +263,15 @@
 			if (!remaining_frees--) break;
 			alloc = NULL;
 		}
+
+		// Size without taking ownership to allow another thread to race to free
+		(void)malloc_size(allocations[pos % live_allocations]);
+
 		alloc = atomic_exchange(
 				(_Atomic(void *) *)&allocations[(pos++)%live_allocations],
 				alloc);
 		if (alloc) {
-			// Size once while allocated
+			// Size again while definitely allocated
 			(void)malloc_size(alloc);
 
 			dummy = busy(second);
@@ -275,7 +279,7 @@
 
 			// Calling malloc_size on free pointers isn't safe in exclaves
 #if !MALLOC_TARGET_EXCLAVES
-			// Try again while (possibly) free
+			// Size again while probably free, but possibly re-allocated
 			malloc_size(alloc);
 #endif // !MALLOC_TARGET_EXCLAVES
 		}