Clang's `-fbounds-safety` is a C language extension designed to prevent out-of-bounds memory accesses by enforcing bounds safety through a combination of compile-time checks and runtime traps. The extension introduces bounds annotations (`__counted_by`, `__sized_by`, `__ended_by`, `__single`, `__bidi_indexable`, `__indexable`, `__null_terminated`, etc.) that programmers attach to pointers to express their valid memory ranges. Local variables implicitly become fat/wide pointers carrying bounds metadata, while ABI-visible pointers (function parameters, struct fields, globals) default to `__single` to preserve ABI compatibility. The model supports incremental adoption, interoperates with unannotated C code via `__unsafe_indexable`, and is portable across toolchains via macro fallbacks. It has already been deployed on millions of lines of production C code in a consumer OS. The document is a design specification; the feature is not yet publicly available.
