[alexfoo]

Ah, good point.

From: https://sploitfun.wordpress.com/2015/02/10/understanding-gli...

    Last 3 bits of this field contains flag information.

        PREV_INUSE (P) – This bit is set when previous chunk is allocated.
        IS_MMAPPED (M) – This bit is set when chunk is mmap’d.
        NON_MAIN_ARENA (N) – This bit is set when this chunk belongs to a thread arena.

It certainly doesn't look like those could be used against ASLR.