make.conf(5) says for both CONFIG_PROTECT and CONFIG_PROTECT_MASK: For more information, please see `emerge --help config`. This should probably be changed to point to emerge(1) instead.
Thanks, this is fixed in svn r8914.
This has been released in 2.1.4_rc10.