https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116855
--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> --- char string2[4095] __attribute__((aligned(1))) = { 2, }; char string[4097] = { 1, }; char * find(int n, char c) { for (int i = 1; i < n; i++) { if (string[i] == c) return &string[i]; } return 0; } get's you .data .align 32 .type string, @object .size string, 4097 string: .string "\001" .zero 4095 .globl string2 .type string2, @object .size string2, 4095 string2: .string "\002" .zero 4093 .section .rodata.cst16,"aM",@progbits,16 so the trick to get an actual faulting testcase would be to either manually unmap .data after string[] or use a guard page that's placed there by other means. I think the sizes of the arrays need to be adjusted as well so when the last element in string[] is the char we search for the misaligned vector access will touch the next page.