Solaris implements PROT_NONE by entirely invalidating the PTE (ie. it becomes zero). Hence our PTEs always had either zero or have the PRESENT bit set. The only exception to this was adding some fixage to allow for the old Xen writable page table approach which temporarily made the upper table non-PRESENT.

So you can make not-present, but non-zero entries mean anything you want. As long as it's the guest OS that creates the entries, we'll just not do it.