These changes could come from either the marlin kernel or the more modern linux-hardened code including changes landed upstream, depending on which ones apply more cleanly.
The real work will start later but it's now at least caught up to the Pixel (XL) with the additional hardening in the 4.4 Android kernel and -fsanitize=local-init thanks to Clang-compiled kernel builds.
These changes could come from either the marlin kernel or the more modern linux-hardened code including changes landed upstream, depending on which ones apply more cleanly.