This is the second part of my write-up on vulnerabilities in the Realtek SD card reader driver. In this part, I will show how exposing device registers to non-privileged users can lead to access to physical memory. The post focuses solely on the DMA vulnerability because its PoC is quite complex. The first part of the write-up, which describes other flaws of the driver, can be found here.