The upper 64 bits doesn't contain the permissions directly, but a value to lookup in a PowerPC style hash page table for the permissions, range, type, etc. If

The upper 64 bits doesn't contain the permissions directly, but a value to lookup in a PowerPC style hash page table for the permissions, range, type, etc. If it encoded it directly, it wouldn't be an object capability system. It only needs to be large enough to cover the number of objects in an address space that are covered by the scheme. It's 128 bit to then round that up to a power of two for hardware reasons but still have a 64but pointer. I could see a Cheri V2 that uses multi level schemes for both the object lookup and the offset address to pack it back into 64 bits, but that's added complexity that's not strictly needed for an MVP of test designs.