My concern is cost. because to find invalid address is
    syscall + uvm_map_lookup_entry(). and we do it for every
    invalid return address found on stack. So if there is some
    way to find/determine invalid return on the stack then this
    will be more than welcomed.

Well, you could learn what ALL the text segments of the binary are.
For dlopen, you can learn them on the fly, later on.