Now that's nice. dillon@ just committed a fix that enables the NX bit for read mappings by default. And the suggestion comes from Theo.
Seems that #Spectre also has some good aspects.
I hope DFBSD adopts PaX NOEXEC. They will need a way to toggle PaX PAGEEXEC and PaX MPROTECT on a per-application basis if so.
We already have both PaX PAGEEXEC and the toggles in #HardenedBSD. Feel free to reach out if you have any questions and I'd be glad to give non-xkcd pointers. ;)