-fstack-protector vs -fstack-protector-strong for x86-64 server binaries under runtime-overhead limits

Goal

I need to select a stack-protector level for x86-64 server binaries built with GCC, bounding runtime overhead while maximizing buffer-overflow coverage.

Constraints

-fstack-protector emits canaries only for functions with local character arrays. -fstack-protector-strong extends coverage to functions with local arrays, address-taken locals, or frame-address references, at added prologue/epilogue cost. GCC does not publish a strict, target-independent list of exactly which functions -fstack-protector-strong instruments; selection depends on front-end/middle-end interaction and target hooks, so coverage can vary by GCC release. Overhead also scales with call frequency, so a latency-sensitive server path must be evaluated on the exact toolchain.

Questions

Does -fstack-protector-strong cover every function with a local array on x86-64 with GCC 12 or later, or are some patterns excluded by target-specific behavior? Under a fixed overhead budget, is the broader coverage of -fstack-protector-strong justified over -fstack-protector for hot server functions? Can the exact instrumented set be determined from documentation alone, or is per-release disassembly inspection required?