Ah nice - I had considered using LD_PRELOAD to do something similar (seeing if I could use mprotect on the mapping), but it felt like too much of an extra complication at the time.

I'd definitely consider giving it a try though if I the code injection becomes too annoying to keep track of doing it the ptrace 8-bytes-at-a-time way.