Add underflow on the malloced buffer

the only way to get in that situation
seeing in dbx malloc allocation, 3.1 allocations while it should be
only Yorktown or bucket, is to have an underflow made on the malloced
buffer :
Like demonstrated in that example :
dbx ./test_under
Type 'help' for help.
reading symbolic information ...
(dbx) l
1 #include <stdio.h>
2 main()
3 {
4 unsigned short *a,*c,*f;
5
6 a=(unsigned short *)malloc(472);
7 c=(unsigned short *)malloc(472);
8 f=c-4;
9 printf("f content=0x%x\n",*f);
10 *f=0xef;
(dbx) l
11 printf("f content=0x%x\n",*f);
12 f=c+(474/2);
13 *f=0xffffffff;
14 }
(dbx) stop in 13
[1] stop at 13
(dbx) run
f content=0x5b5b
f content=0xef
[1] stopped in main at line 13
13 *f=0xffffffff;
(dbx) malloc allocation
Allocations Held by the Process:

ADDRESS SIZE HEAP ALLOCATOR
0x200008c8 472 0 YORKTOWN
0x20000aa8 -7 0 3.1

The checkarena additional checking proposed will not help here as here
the problem is outside of the malloc code itself, so that would detect
it anyway to late.

The only way I see, is to implement a catch_underflow with mprotected
page before, like we do for catch_overflow with an mprotected page
after.

I checked the code to see if there would be an easy way to do this. But
the code is too complex, and too sensible so that I can't produce a fix
and do minimal testing.