For anyone interested, here's the current FreeBSD's implementation code review thread: <a href="https://reviews.freebsd.org/D473" rel="nofollow">https://reviews.freebsd.org/D473</a>
For even better hardening, why not remove the VDSO altogether? Is the VDSO actually necessary, or is it just a way to stay ahead in the benchmark game?