I wonder how Linux manages without explicit _chkstk? In my experience, it feels like MAP_GROWSDOWN regions have way more than 1 guard page below its start — I can poke like a megabyte lower than its start, and the kernel will grow the memory region into there just fine.

According to this article, allocation in page sizes with implicit probing is used;

Stack clash mitigation in GCC, Part 3 (-fstack-clash-protection option) - https://developers.redhat.com/blog/2020/05/22/stack-clash-mi...

PS: Preventing stack guard-page hopping - https://lwn.net/Articles/725832/

It doesn't. This causes the StackClash vulnerability.