Hardware-Gated Driver Bugs Are Reachable From Userland
Hardware-specific Windows driver bugs are not as fenced off as triage usually assumes. Software-emulated device nodes can expose the same kernel attack surface from user mode, so a driver that looks tied to niche hardware may still be a usable local privilege escalation or BYOVD path.
The research shows a way to test reachability without the original device, using Windows kernel-mode drivers on Windows 11 23H2. That matters because BYOVD candidates are often deprioritized when the hardware is missing, and that shortcut can miss drivers that remain exploitable from userland.
The broader risk is that hardware gating no longer reliably narrows the blast radius. A bug thought to live inside a device-specific driver can still become a general-purpose endpoint threat once it can be reached from user mode.