In D46151#1052139, @kib wrote:

Am I right that this revision does not fix the issue, but covers it with more bits from the unused space in the head index? It is still possible that head wraps around, just less likely now that full 2^32 iterations needs to occur under it?

The mtx code appears to be a check that the correct mutex is being held by the kernel so only one thread can access the single-consumer functions at a time. In userspace the tests I wrote don't use a mutex as only one consumer thread is created when testing these functions.

In D46159#1052031, @imp wrote:

Do we care about Arm 8.0? Or will __ARM_FEATURE_ATOMICS not be defined there?

We don't use the vPE table so it's safe to ignore.

It looks like HardenedBSD uses #define AT_PAXFLAGS 35. I assume they stopped merging changes to this list as they didn't have AT_USRSTACK* in their copy of this file.