You wouldn’t be able to guarantee execution of arbitrary ELF, but couldn’t you intentionally build non-PIC-compiled ELF executables where the section base addresses as defined in the header must match the MMU region “slots” the host provides?