Is there a runtime cost or does the hardware run the bounds checks in parallel with memory accesses?   Are the bounds set when malloc() is called or elsewhere?  I read the provided links but can't say I fully understand how it works exactly (which memory blocks are protected, where the bounds get set, when the registers are loaded, etc).

Also, I'm curious about whether we have direct controls over the bounds.  For example, in a listobject.c or _collections.c object could the bounds be tightened to only include the active data and excluded the unused part of the overallocation?