from P0593R5 <http://wg21.link/p0593r5>:

  #include <cstdlib>
  struct X { int a, b; };
  X *make_x() {
    // The call to std::malloc implicitly creates an object of type X
    // and its subobjects a and b in order to give the subsequent
    // class member access operations defined behavior.
    X *p = (X*)std::malloc(sizeof(struct X));
    p->a = 1;
    p->b = 2;
    return p;
  }

AFAIK (since C++17), std::launder() is required to make the access
defined, unless the return value of malloc is said to point to the
created object or something pointer-interconvertible to it. I can't find
such a wording in proposed wordings.

Moreover, the entire paper seems assuming any objects at a same address
are pointer-interconvertible and one reinterpret_cast is sufficient to
get the pointer to intended object.

Am I missing something?

I suspect some more changes are required to achieve the goal of the
paper. (something like more wording on return value of allocations,
or tweaking the pointer-interconvertible rules.)

-- 
k_satoda