I don’t think I understand the your comment, Andrew. I interpreted Tariq saying we essentially restrict RdOnly zero entries to always be the larger numbered ones.
(Sort is the way that HartIndexes are assigned in rhe debug spec) then you can do a binary search to discover the number of potentially non-zero (writable) entries.

I dont think this is strictly backwards compatible, but there’s a good chance that any implementation with PMP entries does it that way.

There may be some RdOnly-nonzero entries below the RdOnly zero entries- but that just means you do a binary search. Only then so you need to check one by one.