[foltik]

From our knowing how it works [0] it’s just a mechanism for the kernel to give up some privileges and add extra security checks when modifying page tables. Sounds easy to emulate to me: just don’t do the checks and modify the page tables directly. Do you have some reason to believe it can’t be emulated?

If for some reason it’s difficult, the relevant kernel code could also be hooked or patched.

[0] https://arxiv.org/abs/2510.09272