SMAP is Pre-Disarmed: How a Stack Pivot That Shouldn't Work Revealed a Kernel-Wide Design Compromise
sibouzitoun.tech
I built a fake stack in user-mode memory and pivoted the kernel into it. SMAP should have thrown a #PF and blue-screened the box. Instead, I got SYSTEM. This is the three-experiment proof that Windows leaves its own guard down.