When we protect PTEs (as opposed to PDEs), we only call vm_page_dirty() when, in fact, we are write protecting the page and the PTE has PG_M set. However, pmap_protect_pde() was always calling vm_page_dirty() when the PDE has PG_M set. So, adding PG_NX to a writeable PDE could result in unnecessary (but harmless) calls to vm_page_dirty().
Simplify the loop calling vm_page_dirty() in pmap_protect_pde().