diff --git a/scripts/build.just b/scripts/build.just
index 7347b77..789befa 100644
--- a/scripts/build.just
+++ b/scripts/build.just
@@ -12,6 +12,7 @@ LIBIWASM_LINUX_DEBUG := env("LIBIWASM_LINUX_DEBUG")
 LIBIWASM_LINUX_RELEASE := env("LIBIWASM_LINUX_RELEASE")
 CROSS_CC := env("CROSS_CC")
 LINUX_CC := env("LINUX_CC")
+WAMR_USE_AOT_SECTION := env_var_or_default("WAMR_USE_AOT_SECTION", "false")
 
 # =================================================================================================================== #
 # Helper recipes
@@ -181,9 +182,9 @@ build-wasm-aot module target="fail":
 [group("1: build module")]
 build-wasm-aot-array module:
     {{ XXD }} -i {{ BUILD_DIR }}-{{ module }}/wasm_module.aot > {{ BUILD_DIR }}-{{ module }}/wasm_aot_array.c
-
-    # Add __attribute__((section...)) to this array, so it is located into the .text.wamr_aot segment...
-    sed -i '1s/^/__attribute__((section(".text.wamr_aot"), aligned(4096)))\n/' {{ BUILD_DIR }}-{{ module }}/wasm_aot_array.c
+    if [ "{{ WAMR_USE_AOT_SECTION }}" = "true" ]; then \
+        sed -i '1s/^/__attribute__((section(".text.wamr_aot"), aligned(4096)))\n/' {{ BUILD_DIR }}-{{ module }}/wasm_aot_array.c; \
+    fi
 
 [doc("WASM -> C-Array: Dump a WASM module to a binary array")]
 [group("1: build module")]
diff --git a/scripts/build.pl b/scripts/build.pl
index 78340dc..10b652b 100755
--- a/scripts/build.pl
+++ b/scripts/build.pl
@@ -23,8 +23,9 @@ my @targets = ( "fail", "linux", "linux-baremetal" );
 my @modes   = ( "c",    "aot",   "interp" );
 
 sub just {
-    say "Running: just @_...";
-    system("$justbin -d $local_root -f $justfile @_")
+    say
+"Running: WAMR_USE_AOT_SECTION=$ENV{WAMR_USE_AOT_SECTION} WAMR_USE_MMAP=$ENV{WAMR_USE_MMAP} WAMR_USE_XIP=$ENV{WAMR_USE_XIP} just @_...";
+    system("$justbin -d $local_root -f $justfile @_ >/dev/null 2>&1")
       and die "Build failed";
     sleep(1);
 }
@@ -45,11 +46,24 @@ my @selected_modes =
   TUI::select_from_list( "Select Execution Modes", 1, @modes );
 die "No mode selected" unless @selected_modes;
 
+# Select .text.wamr_aot section variant
+my @aot_section_variants = (
+    "Place AOT array in .text.wamr_aot",
+    "Let the linker decide where the AOT array is located",
+);
+my @selected_aot_variants =
+  TUI::select_from_list( "Select WAMR Array.Text Variant",
+    1, @aot_section_variants );
+die "No AOT section variant selected" unless @selected_aot_variants;
+
 # Select WAMR mmap variant
-my @wamr_variants = ( "Locate mmap_space in .text.wamr_mmap", "Let the compiler decide where mmap_space is located" );
-my @selected_variants =
-  TUI::select_from_list( "Select WAMR mmap Variant", 1, @wamr_variants );
-die "No variant selected" unless @selected_variants;
+my @mmap_variants = (
+    "Locate mmap_space in .text.wamr_mmap",
+    "Let the linker decide where mmap_space is located"
+);
+my @selected_mmap_variants =
+  TUI::select_from_list( "Select WAMR Mmap.Text Variant", 1, @mmap_variants );
+die "No variant selected" unless @selected_mmap_variants;
 
 # Select XIP variant
 my @xip_variants = ( "Compile AOT with --xip", "Compile AOT without --xip" );
@@ -57,15 +71,23 @@ my @selected_xip_variants =
   TUI::select_from_list( "Select WAMRC XIP Variant", 1, @xip_variants );
 die "No XIP variant selected" unless @selected_xip_variants;
 
+# Select FAIL catch flags (written to runner_flags in each build dir, not a build loop)
+my %catch_flag_map = (
+    "--catch-outer" => "--catch-outerspace",
+    "--catch-text"  => "--catch-write-textsegment",
+);
+my @selected_catch_tags =
+  TUI::select_from_list( "Select FAIL Flags", 1, sort keys %catch_flag_map );
+
 # Select 0.info contents
-my $info = join " ", TUI::select_from_list( "Select '0.info' Contents for ", 1, (
-    "baseline",
-    "--catch-outer",
-    "--catch-text",
-    "wamr_aot",
-    # "wamr_mmap",
-    # "--xip",
-));
+my $info = join " ", TUI::select_from_list(
+    "Select '0.info' Contents for ",
+    1,
+    (
+        # mmap, xip, wamr_aot, --catch-outer, --catch-text are auto-included from variant selections
+        "baseline",
+    )
+);
 
 # Build everything
 # TODO: linux-baremetal target is broken
@@ -73,29 +95,93 @@ system( "mkdir", "-p", "$local_builds_dir" );
 foreach my $experiment (@selected_experiments) {
     foreach my $target (@selected_targets) {
         foreach my $mode (@selected_modes) {
-            foreach my $variant (@selected_variants) {
+            foreach my $mmap_variant (@selected_mmap_variants) {
                 foreach my $xip_variant (@selected_xip_variants) {
-                    # These variables control which libiwasm and wamrc flags are used
-                    local $ENV{WAMR_USE_MMAP} = ( $variant eq "Locate mmap_space in .text.wamr_mmap" ) ? "true" : "false";
-                    local $ENV{WAMR_USE_XIP}  = ( $xip_variant eq "Compile AOT with --xip" )  ? "true" : "false";
+                    foreach my $aot_variant (@selected_aot_variants) {
 
-                    my $date = strftime("%m-%d_%H-%M-%S", localtime);
-                    just( "build", $experiment, $target, $mode );
+                        # Skip redundant combinations where variants don't apply to this mode
+                        # "c"     uses no WAMR at all
+                        # "interp" uses mmap but no AOT
+                        next
+                          if $mode eq "c"
+                          && ( $mmap_variant ne $mmap_variants[0]
+                            || $xip_variant ne $xip_variants[0]
+                            || $aot_variant ne $aot_section_variants[0] );
+                        next
+                          if $mode eq "interp"
+                          && ( $xip_variant ne $xip_variants[0]
+                            || $aot_variant ne $aot_section_variants[0] );
 
-                    my $mmap = $variant eq "Locate mmap_space in .text.wamr_mmap" ? "mmap" : "";
-                    my $xip  = $xip_variant eq "Compile AOT with --xip" ? "xip" : "";
-                    system( "echo '$mode $mmap $info $xip' > $local_root/build-$experiment/0.info" );
+                        # These variables control which libiwasm, wamrc flags, and build options are used
+                        local $ENV{WAMR_USE_MMAP} =
+                          ( $mmap_variant eq
+                              "Locate mmap_space in .text.wamr_mmap" )
+                          ? "true"
+                          : "false";
+                        local $ENV{WAMR_USE_XIP} =
+                          ( $xip_variant eq "Compile AOT with --xip" )
+                          ? "true"
+                          : "false";
+                        local $ENV{WAMR_USE_AOT_SECTION} =
+                          ( $aot_variant eq
+                              "Place AOT array in .text.wamr_aot" )
+                          ? "true"
+                          : "false";
 
-                    my $mmap_name = $mmap eq "mmap" ? "_mmap" : "";
-                    my $xip_name  = $xip  eq "xip"  ? "_xip"  : "";
-                    system(
-                        join " ",
-                        (
-                            "mv",
-                            "$local_root/build-$experiment",
-                            "$local_builds_dir/${date}_${experiment}_${target}_${mode}${mmap_name}${xip_name}",
-                        )
-                    );
+                        my $aot_info =
+                          (      $mode eq "aot"
+                              && $aot_variant eq
+                              "Place AOT array in .text.wamr_aot" )
+                          ? "wamr_aot"
+                          : "";
+                        my $mmap_info =
+                          ( ( $mode eq "aot" || $mode eq "interp" )
+                              && $mmap_variant eq
+                              "Locate mmap_space in .text.wamr_mmap" )
+                          ? "wamr_mmap"
+                          : "";
+                        my $xip_info =
+                          (      $mode eq "aot"
+                              && $xip_variant eq "Compile AOT with --xip" )
+                          ? "xip"
+                          : "";
+                        my $flags_info = join " ", @selected_catch_tags;
+                        my $info_str   = join " ",
+                          grep { length } (
+                            $mode,     $aot_info,   $mmap_info,
+                            $xip_info, $flags_info, $info
+                          );
+
+                        # Build experiment
+                        my $date = strftime( "%m-%d_%H-%M-%S", localtime );
+                        just( "build", $experiment, $target, $mode );
+
+                        # Write extra info for the menu
+                        system(
+                            "echo '$info_str' > $local_root/build-$experiment/0.info"
+                        );
+
+                 # Write runner_flags so runner.pl knows which FAIL flags to use
+                        my $runner_flags_path =
+                          "$local_root/build-$experiment/runner_flags";
+                        open( my $rfh, '>', $runner_flags_path )
+                          or die "Cannot write $runner_flags_path: $!";
+                        print $rfh "$catch_flag_map{$_}\n"
+                          for @selected_catch_tags;
+                        close($rfh);
+
+                        my $aot_name  = $aot_info  ? "_aot-text"  : "";
+                        my $mmap_name = $mmap_info ? "_mmap-text" : "";
+                        my $xip_name  = $xip_info  ? "_xip"       : "";
+                        system(
+                            join " ",
+                            (
+                                "mv",
+                                "$local_root/build-$experiment",
+                                "$local_builds_dir/${date}_${experiment}_${mode}_${target}${aot_name}${mmap_name}${xip_name}",
+                            )
+                        );
+                    }
                 }
             }
         }
diff --git a/scripts/runner.pl b/scripts/runner.pl
index 04bd775..127f016 100644
--- a/scripts/runner.pl
+++ b/scripts/runner.pl
@@ -206,6 +206,15 @@ sub inject {
     );
     say "Server command: $server_command";
 
+    # Read catch flags written by build.pl into the experiment directory
+    my $runner_flags_file = "$remote_builds_dir/$experiment/runner_flags";
+    my @catch_flags = ();
+    if ( -e $runner_flags_file ) {
+        open( my $rfh, '<', $runner_flags_file ) or die "Cannot open $runner_flags_file: $!";
+        @catch_flags = map { chomp; "-Wf,$_" } grep { /\S/ } <$rfh>;
+        close($rfh);
+    }
+
     my $client_command = join " ", (
         "nice $bochs_runner",
         "-V $fail_share/vgabios.bin",
@@ -220,12 +229,7 @@ sub inject {
         "-Wf,--state-dir=$remote_builds_dir/$experiment/state",
         "-Wf,--trap",
 
-        # Catch invalid instruction pointers
-        "-Wf,--catch-outerspace",
-
-        # Messes with Wasm compilation targets if mmap memory is part of .text
-        # (because the linear memory is allocated using os_mmap)
-        "-Wf,--catch-write-textsegment",
+        @catch_flags,
 
         "-Wf,--timeout=500000",
         "-Wf,--ok-marker=fail_marker_positive",