One obvious gotcha with this technique is that a typical attacker will have full access to the assembly code of the target under attack. Therefore, checks against a constant will not be very useful. Fortunately, some microcontrollers are equipped with a hardware random number generator. You can initialize the value of __stack_chk_guard with a function that has __attribute__((constructor)) and does not itself use memory in a way that would cause GCC to issue the stack protector. That way the canary value will be initialized during the startup code before entering main().