@_C_King_123 The actual llvm/linux kernel implementation differs a lot from the paper. Afaik, it currently only covers fwd edges derived from indirect calls.
@kayseesee Do you know if kcfi protects backward edge? It was mentioned in the paper but not on LLVM description of it where it mentions forward edge only. And when it says it only protects function pointers, what are the other indirect branches that it does not protect?