Userland exec was a very interesting read when I came across it some years ago; thanks for publishing it!

The technique still mostly works, but on recent glibc+Linux, you also have to unregister the rseq area before cleaning out the address space (which requires computing the address first, which is a little cumbersome). Otherwise, if the rseq area is registered but unmapped, the kernel will forcefully stop the program.

(That said, nowadays memfd_create + fexecve is likely a more robust alternative in many cases.)