I know at least the Java ZGC use top bits as metadata for a load barrier to check for relocated objects. They fake hardware pointer masking by mapping the the same heap to multiple addresses https://www.opsian.com/blog/javas-new-zgc-is-very-exciting/