[Asooka]

malloc already hands you more than you ask for in a lot of cases, check out malloc_usable_size.

[scarybeast]

This is true. But in the case where the malloc heap metadata is under attack, the attacker will usually just allocate exactly the right size to ensure that the off-by-one goes off the end of the chunk, instead of into slack space.