I think it's fine to leave this as "sets". I assume you changed it because the function does not necessarily set both. Because it's entirely dependent on the function's arguments I think it's still reasonable to say sets. To me "may set" implies that vm_map_protect will itself decide if one/both will be set.
Perhaps "are not allowed to"?
As is (and before your change) it seems unclear to me whether this is something the caller must take care not to violate, or that the function disallows.
Maybe something like
"The map does not allow ..." I think is clearer
Drop If as above, "Both new protection and..."