diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6bb6ac1..7988060 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,35 +10,62 @@ jobs:
   build-and-test:
     runs-on: ubuntu-latest
     container:
-      image: ${{ matrix.distro.image }}
+      image: ${{ matrix.distro[0] }}
       env:
-        LDFLAGS: ${{ matrix.linking.ldflags }}
-        CC: ${{ matrix.compiler.cc }}
-        CXX: ${{ matrix.compiler.cxx }}
+        LDFLAGS: ${{ matrix.link-n-sane[0] }}
+        CC: ${{ matrix.compiler[0] }}
+        CXX: ${{ matrix.compiler[1] }}
+      options: --privileged
     strategy:
+      fail-fast: false
       matrix:
         distro:
-          - { image: "debian:testing", update_cmd: "apt update", install_cmd: "apt install -y" }
-          - { image: "alpine:3.20", update_cmd: "true", install_cmd: "apk add --no-cache", packages: "g++ musl-dev" }
-          - { image: "alpine:edge", update_cmd: "true", install_cmd: "apk add --no-cache", packages: "g++ musl-dev" }
+          - [ "debian:testing", "apt update", "apt install -y" ]
+          - [ "alpine:3.20", "true", "apk add --no-cache", "g++ musl-dev compiler-rt" ]
+          - [ "alpine:edge", "true", "apk add --no-cache", "g++ musl-dev compiler-rt" ]
         compiler:
-          - { cc: gcc, cxx: g++ }
-          - { cc: clang, cxx: clang++ }
-        linking:
-          - { ldflags: "" }
-          - { ldflags: "-static" }
+          - [ gcc, g++ ]
+          - [ clang, clang++ ]
+        link-n-sane:
+          - [ "", "none" ]
+          - [ "-static", "none" ]
+          - [ "", "address,undefined" ]
+          - [ "", "thread" ]
+          - [ "", "memory" ]
+          - [ "", "leak" ]
         options:
           - { pcie_opt: "true" }
           - { pcie_opt: "false" }
+        exclude:
+          - link-n-sane: [ "", "memory" ]
+            compiler: [ gcc, g++ ]
+          - link-n-sane: [ "", "leak" ]
+            distro: [ "alpine:3.20", "true", "apk add --no-cache", "g++ musl-dev compiler-rt" ]
+          - link-n-sane: [ "", "leak" ]
+            distro: [ "alpine:edge", "true", "apk add --no-cache", "g++ musl-dev compiler-rt" ]
+          - link-n-sane: [ "", "thread" ]
+            distro: [ "alpine:3.20", "true", "apk add --no-cache", "g++ musl-dev compiler-rt" ]
+          - link-n-sane: [ "", "thread" ]
+            distro: [ "alpine:edge", "true", "apk add --no-cache", "g++ musl-dev compiler-rt" ]
+          - link-n-sane: [ "", "memory" ]
+            distro: [ "alpine:3.20", "true", "apk add --no-cache", "g++ musl-dev compiler-rt" ]
+          - link-n-sane: [ "", "memory" ]
+            distro: [ "alpine:edge", "true", "apk add --no-cache", "g++ musl-dev compiler-rt" ]
+          - link-n-sane: [ "", "address,undefined" ]
+            distro: [ "alpine:3.20", "true", "apk add --no-cache", "g++ musl-dev compiler-rt" ]
+          - link-n-sane: [ "", "address,undefined" ]
+            distro: [ "alpine:edge", "true", "apk add --no-cache", "g++ musl-dev compiler-rt" ]
     steps:
       - name: Install dependencies
-        run: ${{ matrix.distro.update_cmd }} && ${{ matrix.distro.install_cmd }} git meson ${{ matrix.distro.packages }} ${{ matrix.compiler.cc }}
+        run: ${{ matrix.distro[1] }} && ${{ matrix.distro[2] }} git meson ${{ matrix.distro[3] }} ${{ matrix.compiler[0] }}
       - uses: actions/checkout@v4
         with:
           submodules: true
       - name: Configure
-        run: meson setup --buildtype release --werror -Dpcie_opt=${{ matrix.options.pcie_opt }} build || cat build/meson-logs/meson-log.txt /nonexistent
+        run: meson setup --buildtype release --debug --werror -Dpcie_opt=${{ matrix.options.pcie_opt }} -Db_sanitize=${{ matrix.link-n-sane[1] }} build || cat build/meson-logs/meson-log.txt /nonexistent
       - name: Build
         run: ninja -C build
+      - name: Allow tests to run
+        run: echo 1 > /proc/sys/fs/suid_dumpable
       - name: Run tests
         run: ninja -C build test
diff --git a/meson.build b/meson.build
index 444d3e8..41f06ba 100644
--- a/meson.build
+++ b/meson.build
@@ -31,6 +31,8 @@ catch2 = dependency('catch2-with-main', fallback: 'catch2')
 
 header_dir = 'uhal'
 
+test_env = ['LSAN_OPTIONS=use_tls=0:verbosity=1:log_threads=1']
+
 subdir('include')
 subdir('util')
 subdir('templates')
diff --git a/util/tests/copy-test.cc b/util/tests/copy-test.cc
index 9a1714b..5c5bd1f 100644
--- a/util/tests/copy-test.cc
+++ b/util/tests/copy-test.cc
@@ -3,12 +3,15 @@
 #include <cstring>
 #include <iostream>
 
+#include "defer.h"
+#include "pcie-open.h"
 #include "test-util.h"
 
 int main()
 {
     struct pcie_bars bars;
     dummy_dev_open(bars);
+    defer _(nullptr, [&bars](...){dev_close(bars);});
 
     const size_t s = bars.sizes[1] / sizeof(uint32_t);
     uint32_t *p = reinterpret_cast<uint32_t *>(const_cast<void *>(bars.bar2));
diff --git a/util/tests/meson.build b/util/tests/meson.build
index 135e66f..a5f6c55 100644
--- a/util/tests/meson.build
+++ b/util/tests/meson.build
@@ -14,5 +14,5 @@ tests = [
 ]
 foreach test_name : tests
   exe = executable(test_name, test_name + '.cc', dependencies: [utilities, catch2])
-  test(test_name, exe)
+  test(test_name, exe, env: test_env)
 endforeach
diff --git a/util/tests/test-util.cc b/util/tests/test-util.cc
index 8f95096..e45cac6 100644
--- a/util/tests/test-util.cc
+++ b/util/tests/test-util.cc
@@ -1,3 +1,4 @@
+#include <sys/mman.h>
 #include <stdexcept>
 
 #include "test-util.h"
@@ -18,7 +19,7 @@ void dummy_dev_open(struct pcie_bars &bars)
 
     auto allocate_bar = [](volatile void *&ptr, size_t &size, size_t desired_size) {
         size = desired_size;
-        ptr = malloc(size);
+        ptr = mmap(0, desired_size, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
     };
 
     /* same sizes as our devices */