Take the set of addresses that are pointed to by the program counter during execution. They are off-limit.
Things are a bit more murky with variable-length instructions, but basically you are not allowed to read as data any address that is ever read as part of instruction decoding.
> Take the set of addresses that are pointed to by the program counter during execution. They are off-limit.
How do you know which addresses those will be? If the underlying architecture and OS permit reads or writes of code segments and/or execution of data segments, this set of addresses is literally undecidable.
Sorry for the late reply. It doesn't matter that this set of addresses is undecidable: so is the halting problem and yet we can precisely define the set of halting programs.
You don't have to know these adresses beforehand, so you can just run the program to collect them and check. Or you roll up your sleeves and do some maths to compute (an overapproximation of) that set for the specific program you're interested in, which may be your only option if your architecture is nondeterministic.
Things are a bit more murky with variable-length instructions, but basically you are not allowed to read as data any address that is ever read as part of instruction decoding.