While ptmalloc/dlmalloc/tcmalloc use a single-linked list meta-data that is stored adjacent to the user buffers, in jemalloc there is no such meta-data. jemalloc's design stores the sensitive meta-data separately, thus removing the need to add a dedicated protection layer for it.
Not yet. Working with each open-source demanded a lot of effort, so we were hoping that integrating it into a few dominant libraries will attract the attention of the rest. We will happily assist them if they need/want our help.
We can detect corruption in 15/16 times. In our tests, when we didn't detect a corruption, the program still crashed, but without a proper error message. One should remember that the pointer is masked, so an attacker without the secret mask won't be able to control the reveal()ed pointer. And using a garbled pointer won't give the attacker anything useful, and most probably it will crash the target program.
We executed the benchmark suite multiple times, and results were consistent. It was way more stable than the same execution on a PC with multiple programs. Anyway, the maintainers of glibc performed the same checks and confirmed our measurements.
Glad to hear that they took our advice, and enabled automatic firmware updates by default. We suggested this feature when we helped them fix the fax vulnerabilities (DEFCON 26 - What The FAX?!), happy to see they listened.