I'd be tempted to ask the same question. I assume smarter people than me concluded it was a necessity, but the reasons are not clearly laid out in any of these late discussions.

It seems like userspace can deal with the layout of kernel structures for e.g., ioctl, though it might be quite messy.

The kernel prepares a few mappings for every process: heap, vvar, vdso, and stack in my /proc/self/maps. It would need a flag to say to locate these below the 4G (2G?) limit instead.

But I suppose the startup code for some "altx32" could allocate its own main stack, the runtime include trampolines for vdso, and entirely eschew use of brk() for memory allocation.

If you did all that -- do you really need different syscalls? Well, mmap(NULL, ...) needs to return below the 32-bit limit, for one. How many more syscalls allocate address space or return pointers? Whatever implements shmat() is another one. Can you fix all these by making a PROT_NONE mapping for the whole memory range above the 32-bit limit, and then these routines simply get to hunt for a low address?