I'm very close to considering the current default required=0 a bug..(will follow up with a separate PR tonight or tomorrow).  Reason behind that is twofold:

1)  in xen/arch/x86/mm/p2m.c, the events-enabled-but-handler-died scenario is handled in an effective (but brutal) fashion. If access_required == 1, the previous bugs we experienced with events remaining in the ring would have actually killed the domain..arguably less pleasant, but certainly enforcing correctness..
        /* No listener */
        if ( p2m->access_required )
        {  
            gdprintk(XENLOG_INFO, "Memory access permissions failure, "
                                  "no mem_event listener VCPU %d, dom %d\n",
                                  v->vcpu_id, d->domain_id);
            domain_crash(v->domain);
            return 0;
        }

2) in the other half of the same conditional referenced above, we see the below comment..which to me suggests that without access_required==1, the access permissions set via LibVMI (and programmer expectations) are likely to become out of sync with reality.

   /* A listener is not required, so clear the access
                 * restrictions.  This set must succeed: we have the
                 * gfn locked and just did a successful get_entry(). */