diff -r 87206b32d3b1 -r bf18f4a8eaa7 libexec/ld.elf_so/tls.c
--- a/libexec/ld.elf_so/tls.c	Tue Jul 21 04:04:26 2026 +0000
+++ b/libexec/ld.elf_so/tls.c	Wed Jul 22 14:06:23 2026 +0000
@@ -318,7 +318,12 @@ static struct tls_tcb *
 	assert(ALIGNED_P(p, alignof(struct tls_tcb)));
 	tcb = (struct tls_tcb *)p;
 	p += sizeof(struct tls_tcb);
+#ifdef __HAVE___LWP_SETTCB
 	assert(ALIGNED_P(p, _rtld_tls_static_max_align));
+#else
+	assert((uintptr_t)p % _rtld_tls_static_max_align ==
+	    sizeof(struct tls_tcb) % _rtld_tls_static_max_align);
+#endif
 	lo = p;
 #else
 	lo = p;
@@ -470,11 +475,25 @@ static void *
 		_rtld_die();
 	}
 	if (obj->tls_static) {
+		uint8_t *lo __debugused, *hi __debugused;
+
+		assert(obj->tlsoffset <= _rtld_tls_static_space);
+		assert(obj->tlssize <= _rtld_tls_static_space);
 #ifdef __HAVE_TLS_VARIANT_I
+		assert(obj->tlsoffset <= _rtld_tls_static_space -
+		    obj->tlssize);
 		p = (uint8_t *)tcb + obj->tlsoffset + sizeof(struct tls_tcb);
+		lo = (uint8_t *)tcb + sizeof(struct tls_tcb);
+		hi = lo + _rtld_tls_static_space;
 #else
+		assert(obj->tlssize <= obj->tlsoffset);
 		p = (uint8_t *)tcb - obj->tlsoffset;
+		hi = (uint8_t *)tcb;
+		lo = hi - _rtld_tls_static_space;
 #endif
+		assert(ALIGNED_P(p, obj->tlsalign));
+		assert(lo <= p);
+		assert(p + obj->tlssize <= hi);
 		return p;
 	}
 
@@ -538,15 +557,21 @@ int
 #ifdef __HAVE_TLS_VARIANT_I
 	offset = roundup2(_rtld_tls_static_offset, obj->tlsalign);
 	next_offset = offset + obj->tlssize;
-#ifndef __HAVE___LWP_GETTCB_FAST
+#ifdef __HAVE___LWP_GETTCB_FAST
+	assert(ALIGNED_P(offset, obj->tlsalign));
+#else
 	offset -= sizeof(struct tls_tcb);
+	assert(obj->tlsalign == 0 ||
+	    offset % obj->tlsalign ==
+	    (-(ptrdiff_t)sizeof(struct tls_tcb)) % obj->tlsalign);
+	assert(ALIGNED_P(offset + sizeof(struct tls_tcb), obj->tlsalign));
 #endif
 #else
 	offset = roundup2(_rtld_tls_static_offset + obj->tlssize,
 	    obj->tlsalign);
 	next_offset = offset;
+	assert(ALIGNED_P(offset, obj->tlsalign));
 #endif
-	assert(ALIGNED_P(offset, obj->tlsalign));
 
 	/*
 	 * Check if the static allocation was already done.