diff --git a/SMPBasicBlock.cpp b/SMPBasicBlock.cpp
index a6e0cd5c38d7cd7e3287e8596a35acc7aa5f5f71..15cb5fdb870df589e407f8c8da388047c695348d 100644
--- a/SMPBasicBlock.cpp
+++ b/SMPBasicBlock.cpp
@@ -1272,7 +1272,7 @@ void SMPBasicBlock::MarkBranchSignedness(void) {
 	bool LocalFlags;  // is flags register a local name?
 	list<SMPInstr *>::reverse_iterator InstRevIter;
 
-	InstRevIter = this->Instrs.rbegin(); // Any conditional branch would be last instruction
+	InstRevIter = this->GetRevInstBegin(); // Any conditional branch would be last instruction
 	SMPInstr *LastInst = (*InstRevIter);
 	if (LastInst->MDIsUnsignedBranch()) {
 		SignMask = FG_MASK_UNSIGNED;
@@ -2792,13 +2792,14 @@ bool SMPBasicBlock::IsDefRedefinedByAddition(ea_t DefAddr, op_t DefOp, ea_t &Add
 } // end of SMPBasicBlock::IsDefRedefinedByAddition()
 
 // Does value of DefOp/DefSSANum reach block end in any computation of any DEF at all?
-bool SMPBasicBlock::DoesDefReachBlockEnd(ea_t DefAddr, op_t DefOp, int DefSSANum) {
+bool SMPBasicBlock::DoesDefReachBlockEnd(ea_t DefAddr, op_t DefOp, int DefSSANum, set<int> NonEscapingRegisterHashes) {
 	set<op_t, LessOp>::iterator LocalIter = this->LocalNames.find(DefOp);
 	bool LocalName = (LocalIter != this->LocalNames.end());
 	unsigned int DUIndex;
 	size_t NumChains, NumUses;
 	bool DoesEscape = false;
 	bool UseFP = this->GetFunc()->UsesFramePointer();
+	// set<int> NonEscapingRegisterHashes; // memoization optimization: set of register/SSA# hashes that do not reach end of block
 
 	// If we encounter indirect memory operands of any kind, we cannot track them and must
 	//  assume they are loop-variant and reach outside this block. Ditto for non-reg,
@@ -2832,16 +2833,31 @@ bool SMPBasicBlock::DoesDefReachBlockEnd(ea_t DefAddr, op_t DefOp, int DefSSANum
 				set<DefOrUse, LessDefUse>::iterator NextDefIter = NextInst->GetFirstNonFlagsDef();
 				if (NextDefIter != NextInst->GetLastDef()) {
 					// Instruction does something besides define the flags. That does not prove that
-					//  our DefOp argument is transferred in any way to the next DEF, because out DefOp
+					//  our DefOp argument is transferred in any way to the next DEF, because our DefOp
 					//  could just be used as an addressing register in NextInst.
 					if (NextInst->OperandTransfersValueToDef(DefOp)) {
 						op_t NextDefOp = NextDefIter->GetOp();
 						int NextDefSSANum = NextDefIter->GetSSANum();
+						bool RegNextDef = (o_reg == NextDefOp.type);
+						int NextDefHashValue;
+						if (RegNextDef) {
+							NextDefHashValue = HashGlobalNameAndSSA(NextDefOp, NextDefSSANum);
+							if (NonEscapingRegisterHashes.find(NextDefHashValue) != NonEscapingRegisterHashes.end()) {
+								// We have already determined that NextDef does not reach the end of the block.
+								continue;
+							}
+						}
 						ea_t NextDefAddr = UseAddr;
-						if (this->DoesDefReachBlockEnd(NextDefAddr, NextDefOp, NextDefSSANum)) {
+						if (this->DoesDefReachBlockEnd(NextDefAddr, NextDefOp, NextDefSSANum, NonEscapingRegisterHashes)) {
 							DoesEscape = true;
 							break;
 						}
+						else if (RegNextDef) {
+							// Memoize this result to save time reanalyzing it for other def-use chains.
+							pair<set<int>::iterator, bool> InsertResult;
+							InsertResult = NonEscapingRegisterHashes.insert(NextDefHashValue);
+							assert(InsertResult.second);
+						}
 					}
 				}
 			} // end for all uses in DU-chain
@@ -2885,16 +2901,33 @@ bool SMPBasicBlock::DoesDefReachBlockEnd(ea_t DefAddr, op_t DefOp, int DefSSANum
 					if (NextInst->OperandTransfersValueToDef(DefOp)) {
 						op_t NextDefOp = NextDefIter->GetOp();
 						int NextDefSSANum = NextDefIter->GetSSANum();
+						bool RegNextDef = (o_reg == NextDefOp.type);
+						int NextDefHashValue;
+						if (RegNextDef) {
+							NextDefHashValue = HashGlobalNameAndSSA(NextDefOp, NextDefSSANum);
+							if (NonEscapingRegisterHashes.find(NextDefHashValue) != NonEscapingRegisterHashes.end()) {
+								// We have already determined that NextDef does not reach the end of the block.
+								continue;
+							}
+						}
 						ea_t NextDefAddr = UseAddr;
-						if (this->DoesDefReachBlockEnd(NextDefAddr, NextDefOp, NextDefSSANum)) {
+						if (this->DoesDefReachBlockEnd(NextDefAddr, NextDefOp, NextDefSSANum, NonEscapingRegisterHashes)) {
 							DoesEscape = true;
 							break;
 						}
+						else if (RegNextDef) {
+							// Memoize this result to save time reanalyzing it for other def-use chains.
+							pair<set<int>::iterator, bool> InsertResult = NonEscapingRegisterHashes.insert(NextDefHashValue);
+							assert(InsertResult.second);
+						}
 					}
 				}
 			} // end for all uses in DU-chain
 		}
 	}
+
+	NonEscapingRegisterHashes.clear();
+
 	return DoesEscape;
 } // end of SMPBasicBlock::DoesDefReachBlockEnd()
 
diff --git a/SMPBasicBlock.h b/SMPBasicBlock.h
index 9c3028d2ea4e8d6399a555fca71f086d91b8b239..e84603ae6df426f1bafa567896937532f5d530e0 100644
--- a/SMPBasicBlock.h
+++ b/SMPBasicBlock.h
@@ -108,6 +108,8 @@ public:
 #endif
 	inline list<SMPInstr *>::iterator GetFirstInstr(void) { return Instrs.begin(); };
 	inline list<SMPInstr *>::iterator GetLastInstr(void) { return Instrs.end(); };
+	inline list<SMPInstr *>::reverse_iterator GetRevInstBegin(void) { return Instrs.rbegin(); };
+	inline list<SMPInstr *>::reverse_iterator GetRevInstEnd(void) { return Instrs.rend(); };
 	inline list<SMPBasicBlock *>::iterator GetFirstPred(void) {
 		return Predecessors.begin();
 	};
@@ -269,7 +271,7 @@ public:
 	void MarkDeadRegs(void); // Find dead registers for each mmStrata-instrumented instruction
 	bool IsDefDead(ea_t DefAddr, op_t DefOp); // Does DefOp at DefAddr never get used?
 	bool IsDefRedefinedByAddition(ea_t DefAddr, op_t DefOp, ea_t &AdditionAddr); // true if DefOp at DefAddr is redefined by addition; pass back AdditionAddr
-	bool DoesDefReachBlockEnd(ea_t DefAddr, op_t DefOp, int DefSSANum); // Does value of DefOp/DefSSANum reach block end in any DEF at all?
+	bool DoesDefReachBlockEnd(ea_t DefAddr, op_t DefOp, int DefSSANum, set<int> NonEscapingRegisterHashes); // Does value of DefOp/DefSSANum reach block end in any DEF at all?
 	bool PropagateLocalDefType(op_t DefOp, SMPOperandType DefType, ea_t DefAddr, int SSANum, bool IsMemOp); // to all uses
 	bool InferLocalDefType(op_t DefOp, unsigned int LocIndex, ea_t DefAddr); // Can DEF type be inferred from all USEs?
 	void InferGlobalDefType(op_t DefOp, int SSANum, ea_t DefAddr, bool &FoundNumeric, bool &FoundPointer,
diff --git a/SMPFunction.cpp b/SMPFunction.cpp
index 3de936e61ae14bb4e3bf1bcaa5c03634fd69bd57..f017181b6f1a007a97adb9a8c0166c343c0fb461 100644
--- a/SMPFunction.cpp
+++ b/SMPFunction.cpp
@@ -6605,6 +6605,7 @@ void SMPFunction::FindCounterVariables(void) {
 bool SMPFunction::CounterVarHelper(op_t DefOp, int DefSSANum, int BlockNum, bool LocalName, list<pair<int, ea_t> > CounterSSANums) {
 	bool ListExpanded = false;
 	size_t IncomingListSize = CounterSSANums.size();
+	set<int> NonEscapingRegisterHashes;
 
 	// First, examine the Phi list to find uses of DefOp/DefSSANum.
 	// Next, examine instructions to find uses of DefOp/DefSSANum. They must be counter operations if DefOp is re-defed.
@@ -6617,7 +6618,8 @@ bool SMPFunction::CounterVarHelper(op_t DefOp, int DefSSANum, int BlockNum, bool
 	SMPBasicBlock *CurrBlock = this->GetBlockByNum((size_t) BlockNum);
 	assert(NULL != CurrBlock);
 	ea_t DefAddr = CounterSSANums.front().second;
-	if (CurrBlock->DoesDefReachBlockEnd(DefAddr, DefOp, DefSSANum)) {
+	if (CurrBlock->DoesDefReachBlockEnd(DefAddr, DefOp, DefSSANum, NonEscapingRegisterHashes)) {
+		NonEscapingRegisterHashes.clear(); // Not memoizing for this use of DoesDefReachBlockEnd()
 		bool LoopSuccFound = false;
 		list<SMPBasicBlock *>::iterator SuccIter;
 		SMPBasicBlock *SuccBlock;
@@ -6923,7 +6925,7 @@ bool SMPFunction::PropagateSignedness(void) {
 // Detect and mark special cases before emitting numeric error annotations.
 void SMPFunction::MarkSpecialNumericErrorCases(void) {
 	list<SMPBasicBlock *>::iterator BlockIter;
-	list<SMPInstr *>::iterator InstIter;
+	list<SMPInstr *>::reverse_iterator InstIter;
 	SMPBasicBlock *CurrBlock;
 	SMPInstr *CurrInst;
 
@@ -6931,6 +6933,8 @@ void SMPFunction::MarkSpecialNumericErrorCases(void) {
 		return;
 	}
 
+	set<int> NonEscapingRegisterHashes; // memoization optimization: set of register/SSA# hashes that do not reach end of block
+
 #if STARS_BUILD_LOOP_BITSET
 	// Now that we know how many loops we have, we can allocate the loops data structure.
 	this->FuncLoopsByBlock.resize(this->BlockCount);
@@ -6955,7 +6959,9 @@ void SMPFunction::MarkSpecialNumericErrorCases(void) {
 			bool AddFound = false;
 			op_t DefOp = InitOp;
 			set<DefOrUse, LessDefUse>::iterator DefIter;
-			for (InstIter = CurrBlock->GetFirstInstr(); InstIter != CurrBlock->GetLastInstr(); ++InstIter) {
+			NonEscapingRegisterHashes.clear();
+
+			for (InstIter = CurrBlock->GetRevInstBegin(); InstIter != CurrBlock->GetRevInstEnd(); ++InstIter) {
 				CurrInst = (*InstIter);
 				if ((!ShiftFound) && CurrInst->MDIsHashingArithmetic()) {
 					// If the operand being shifted is never used in any assignment or arithmetic
@@ -6972,7 +6978,7 @@ void SMPFunction::MarkSpecialNumericErrorCases(void) {
 					if (ShiftFound) {
 						SMPInstr *AdditionInst = this->GetInstFromAddr(AdditionAddr);
 						DefIter = CurrInst->GetFirstNonFlagsDef();
-						AddFound = CurrBlock->DoesDefReachBlockEnd(AdditionAddr, DefOp, DefIter->GetSSANum());
+						AddFound = CurrBlock->DoesDefReachBlockEnd(AdditionAddr, DefOp, DefIter->GetSSANum(), NonEscapingRegisterHashes);
 						if (AddFound) {
 							break;
 						}
@@ -6989,8 +6995,9 @@ void SMPFunction::MarkSpecialNumericErrorCases(void) {
 				//  changing within the loop, but if they are not, they are probably not exploitable overflows anyway,
 				//  and the loop-invariant overflow would happen on every loop iteration based on initial values, which
 				//  is a pattern we have never seen for this kind of code.
-				for (InstIter = CurrBlock->GetFirstInstr(); InstIter != CurrBlock->GetLastInstr(); ++InstIter) {
-					CurrInst = (*InstIter);
+				list<SMPInstr *>::iterator ForwardInstIter;
+				for (ForwardInstIter = CurrBlock->GetFirstInstr(); ForwardInstIter != CurrBlock->GetLastInstr(); ++ForwardInstIter) {
+					CurrInst = (*ForwardInstIter);
 					if (CurrInst->MDIsOverflowingOpcode() || CurrInst->MDIsUnderflowingOpcode() || CurrInst->MDIsLoadEffectiveAddressInstr()) {
 						CurrInst->SetHashOperation();
 					}
@@ -6999,6 +7006,7 @@ void SMPFunction::MarkSpecialNumericErrorCases(void) {
 		} // end if loop header and loop tail
 	} // end for all blocks
 
+	NonEscapingRegisterHashes.clear();
 	return;
 } // end of SMPFunction::MarkSpecialNumericErrorCases()
 
diff --git a/SMPInstr.cpp b/SMPInstr.cpp
index f3bdc1309f9381f055bfb9748056f49a04bc65cb..a5e907146693acc46a2fd7a8ce92dd96648b61aa 100644
--- a/SMPInstr.cpp
+++ b/SMPInstr.cpp
@@ -7343,6 +7343,7 @@ void SMPInstr::EmitIntegerErrorAnnotations(FILE *InfoAnnotFile) {
 			assert(DefIter != this->GetLastDef());
 			DefOp = DefIter->GetOp();
 			SSANum = DefIter->GetSSANum();
+			SMPOperandType DefType = DefIter->GetType();
 			bool IgnoreOverflow = this->IsBenignOverflow(IdiomCode);
 			uval_t ConstValue = 0;
 			// NOTE: We no longer suppress the IgnoreOverflow annotations. Instead, we print
@@ -7451,16 +7452,38 @@ void SMPInstr::EmitIntegerErrorAnnotations(FILE *InfoAnnotFile) {
 				}
 				AnnotPrintOperand(AnnotDefOp, InfoAnnotFile);
 				string SinkString("");
-				// See if we made a special detection of an operation involved in a hash function, which can
-				//  be expected to overflow benignly.
-				if ((!IgnoreOverflow) && (this->IsHashOperation())) {
-					IgnoreOverflow = true;
-					IdiomCode = 15;
+				if (!IgnoreOverflow) {
+					// See if we made a special detection of an operation involved in a hash function, which can
+					//  be expected to overflow benignly.
+					if (this->IsHashOperation()) {
+						IgnoreOverflow = true;
+						IdiomCode = 15;
+					}
+					else if (IsDataPtr(DefType)) {
+						// IDIOM 18 says to let C7 (buffer overflow/underflow) defenses handle the issues if it is a pointer.
+						IgnoreOverflow = true;
+						IdiomCode = 18;						
+					}
 				}
 				if (IgnoreOverflow) {
 					if (11 == IdiomCode) {
 						SMP_fprintf(InfoAnnotFile, " ZZ IDIOM %d CONST %u %s \n", IdiomCode, ConstValue, disasm);
 					}
+					else if (18 == IdiomCode) {
+						// Need a tag field telling what kind of pointer.
+						if (IsEqType(DefType, STACKPTR)) {
+							SMP_fprintf(InfoAnnotFile, " ZZ IDIOM %d STACKMEMSINK %s \n", IdiomCode, disasm);
+						}
+						else if (IsEqType(DefType, HEAPPTR)) {
+							SMP_fprintf(InfoAnnotFile, " ZZ IDIOM %d HEAPMEMSINK %s \n", IdiomCode, disasm);
+						}
+						else if (IsEqType(DefType, GLOBALPTR)) {
+							SMP_fprintf(InfoAnnotFile, " ZZ IDIOM %d GLOBALMEMSINK %s \n", IdiomCode, disasm);
+						}
+						else { // must be unrefined POINTER type.
+							SMP_fprintf(InfoAnnotFile, " ZZ IDIOM %d MEMORYSINK %s \n", IdiomCode, disasm);
+						}
+					}
 					else {
 						SMP_fprintf(InfoAnnotFile, " ZZ IDIOM %d %s \n", IdiomCode, disasm);
 					}
@@ -8131,7 +8154,9 @@ void SMPInstr::MDEmitLeaOpcodeOverflowAnnotations(FILE *InfoAnnotFile) {
 	int SignedOffset;
 	bool ScaledIndexReg;
 	bool SourceFound = false;
+	bool DataPointer = false;
 	int SSANum;
+	SMPOperandType DefType;
 	int UseHashValue;
 	int IdiomCode = 0;
 	struct FineGrainedInfo UseFGInfo, SourceDefFGInfo;
@@ -8168,6 +8193,8 @@ void SMPInstr::MDEmitLeaOpcodeOverflowAnnotations(FILE *InfoAnnotFile) {
 		assert(DefIter != this->GetLastDef());
 		op_t DefOp = DefIter->GetOp();
 		SSANum = DefIter->GetSSANum();
+		DefType = DefIter->GetType();
+		DataPointer = IsDataPtr(DefType);
 		if (this->IsHashOperation()) {
 			IdiomCode = 15;
 		}
@@ -8190,6 +8217,20 @@ void SMPInstr::MDEmitLeaOpcodeOverflowAnnotations(FILE *InfoAnnotFile) {
 	//  CHECK OVERFLOW annotations after each step.
 	string CurrString("");
 	const char *ScaleStrings[4] = {"", "*2", "*4", "*8"};
+	string PtrString("");
+	if (DataPointer) {
+		if (IsEqType(STACKPTR, DefType))
+			PtrString = "STACKMEMSINK";
+		else if (IsEqType(HEAPPTR, DefType))
+			PtrString = "HEAPMEMSINK";
+		else if (IsEqType(GLOBALPTR, DefType))
+			PtrString = "GLOBALMEMSINK";
+		else
+			PtrString = "MEMORYSINK";
+		if (0 == IdiomCode) {
+			IdiomCode = 18;
+		}
+	}
 	op_t RegOp;
 	RegOp.type = o_reg;
 
@@ -8275,9 +8316,16 @@ void SMPInstr::MDEmitLeaOpcodeOverflowAnnotations(FILE *InfoAnnotFile) {
 			CurrString += RegNames[IndexReg];
 			CurrString += ScaleStrings[ScaleFactor];
 			if (IdiomCode > 0) {
-				SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
-					this->address, this->SMPcmd.size, LeaSignednessStrings[UseSignMask], 
-					IndexRegMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+				if (IdiomCode == 18) {
+					SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s %s \n",
+						this->address, this->SMPcmd.size, LeaSignednessStrings[UseSignMask], 
+						IndexRegMaxWidth, CurrString.c_str(), IdiomCode, PtrString.c_str(), disasm);
+				}
+				else {
+					SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
+						this->address, this->SMPcmd.size, LeaSignednessStrings[UseSignMask], 
+						IndexRegMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+				}
 			}
 			else {
 				SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ %s \n",
@@ -8295,9 +8343,16 @@ void SMPInstr::MDEmitLeaOpcodeOverflowAnnotations(FILE *InfoAnnotFile) {
 				CurrString += "+";
 				CurrString += TempStr;
 				if (IdiomCode > 0) {
-					SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
-						this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
-						TempMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+					if (IdiomCode == 18) {
+						SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s %s \n",
+							this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
+							TempMaxWidth, CurrString.c_str(), IdiomCode, PtrString.c_str(), disasm);
+					}
+					else {
+						SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
+							this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
+							TempMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+					}
 				}
 				else {
 					SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ %s \n",
@@ -8318,9 +8373,16 @@ void SMPInstr::MDEmitLeaOpcodeOverflowAnnotations(FILE *InfoAnnotFile) {
 
 				CurrString += OffsetString;
 				if (IdiomCode > 0) {
-					SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
-						this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
-						TempMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+					if (IdiomCode == 18) {
+						SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s %s \n",
+							this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
+							TempMaxWidth, CurrString.c_str(), IdiomCode, PtrString.c_str(), disasm);
+					}
+					else {
+						SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
+							this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
+							TempMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+					}
 				}
 				else {
 					SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ %s \n",
@@ -8338,9 +8400,16 @@ void SMPInstr::MDEmitLeaOpcodeOverflowAnnotations(FILE *InfoAnnotFile) {
 			CurrString += "+";
 			CurrString += RegNames[IndexReg];
 			if (IdiomCode > 0) {
-				SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
-					this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
-					TempMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+				if (IdiomCode == 18) {
+					SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s %s \n",
+						this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
+						TempMaxWidth, CurrString.c_str(), IdiomCode, PtrString.c_str(), disasm);
+				}
+				else {
+					SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
+						this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
+						TempMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+				}
 			}
 			else {
 				SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ %s \n",
@@ -8359,9 +8428,16 @@ void SMPInstr::MDEmitLeaOpcodeOverflowAnnotations(FILE *InfoAnnotFile) {
 
 				CurrString += OffsetString;
 				if (IdiomCode > 0) {
-					SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
-						this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
-						TempMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+					if (IdiomCode == 18) {
+						SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s %s \n",
+							this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
+							TempMaxWidth, CurrString.c_str(), IdiomCode, PtrString.c_str(), disasm);
+					}
+					else {
+						SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
+							this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
+							TempMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+					}
 				}
 				else {
 					SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ %s \n",
@@ -8383,9 +8459,16 @@ void SMPInstr::MDEmitLeaOpcodeOverflowAnnotations(FILE *InfoAnnotFile) {
 
 			CurrString += OffsetString;
 			if (IdiomCode > 0) {
-				SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
-					this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
-					TempMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+				if (IdiomCode == 18) {
+					SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s %s \n",
+						this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
+						TempMaxWidth, CurrString.c_str(), IdiomCode, PtrString.c_str(), disasm);
+				}
+				else {
+					SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
+						this->address, this->SMPcmd.size, LeaSignednessStrings[TempSignMask], 
+						TempMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+				}
 			}
 			else {
 				SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ %s \n",
@@ -8414,9 +8497,16 @@ void SMPInstr::MDEmitLeaOpcodeOverflowAnnotations(FILE *InfoAnnotFile) {
 
 		CurrString += OffsetString;
 		if (IdiomCode > 0) {
-			SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
-				this->address, this->SMPcmd.size, LeaSignednessStrings[BaseRegSignMask], 
-				BaseRegMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+			if (IdiomCode == 18) {
+				SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s %s \n",
+					this->address, this->SMPcmd.size, LeaSignednessStrings[BaseRegSignMask], 
+					BaseRegMaxWidth, CurrString.c_str(), IdiomCode, PtrString.c_str(), disasm);
+			}
+			else {
+				SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ IDIOM %d %s \n",
+					this->address, this->SMPcmd.size, LeaSignednessStrings[BaseRegSignMask], 
+					BaseRegMaxWidth, CurrString.c_str(), IdiomCode, disasm);
+			}
 		}
 		else {
 			SMP_fprintf(InfoAnnotFile, "%10x %6d INSTR CHECK OVERFLOW %s %zu %s ZZ %s \n",