Money quote: “Essentially, [CAPCOM.SYS] provides ring-0 code execution as a service! Its only function is to take a userland pointer, disable SMEP [thus allowing the kernel to execute from userland-owned pages], execute code at the pointer address and re-enable SMEP.”