Besides the "S" option for malloc.conf and increasing kern.stackgap_random and removing the wxallowed mount option, what else memory-related hardening mechanism are in OpenBSD that can be turned on and it is not enabled by default?
Even options would be useful if we have to re-compile the kernel, if minimal source code modification is needed.
Usually they don't enable it because many application, exampe from ports would crash because of bad code.
Tried to get lists/ideas from grsecurity (if there is any, that is not already used in OpenBSD), but it is hard when you are not a programmer: https://grsecurity.net/features.php
securelevel=2
man.openbsd.org/securelevel prevents non-console root from doing some nasty things.pledge
man.openbsd.org/pledge is "on" by default but some programs need to incorporate it in their source code