'Gankra answers the cast part but for the other question: PAC is "pointer authentication codes", which is pretty much what it sounds like. It's a CFI+data integrity protection measure. Re: temporal memory safety, I don't think MTE solves everything but my understanding was you can revoke a capability for a region when the memory is freed and then mint it with a new one when allocating it out again, which would make stale pointers to it/UAF fault on access. Will have to check what the exact details are.