There are lots of those kinds of exploits if the one-bit overflow gives you control of a pointer. That doesn't work in Fil-C; the pointer's capability is protected in that case.

There are many orders of magnitude fewer real exploits using intra-struct overflow without pointer control than there are exploits using vanilla logic bugs (like the programmer forgot to check the is_admin bit before proceeding to the admin privileges business logic).

So, obsessing over intra-struct overflows in a language that prevents ptr-int type confusion is missing the plot.

(Believe me, if intra-struct overflows over primitives were a big threat, I'd change the Fil-C policy.)