@mcc I remember openbsd doing something like that a couple years ago, maybe for their own kernel and not userland binary. A similar trick they tried I like was instead of using NOP to pad function, they used an instruction that caused a kernel panic. Legitimate code never reach that portion because there is a JMP/return before. But when gadget are lacking, sometimes an hack would jump into the NOP slide and reach the following code block. Turning the slide into a trap prevent thag.