It appears mprotect is setting the write protect bit of the storage key, but this is being undone shortly after:
-> 00031F1E' SSKE B22B0013 00000006 0CF0D203 CC 1 <--- Write okay when storage got by mmap -> 00400790" ST 50102000 >> 40018000 CC 1 <--- 1234 stored V40018000 00001234 06 L0CF0D000 -> 0003A168' SSKE B22B0002 00000000 0CF0D201 CC 1 <--- Write disabled -> 00031D36' SSKE B22B0012 00000006 0CF0D001 CC 1 <--- Write re-enabled -> 004007E4" ST 50201000 >> 40018000 CC 0 <--- 1235 stored V40018000 00001235 06 L0CF0D000 According to my System.map 0x31d36 is +22e in do_wp_page() which is in mm/memory.c.
