There was memory protection (paging, separate address spaces etc), but it was possible to enter kernel mode code (CPL=0) from user space code (CPL=3) simply by

There was memory protection (paging, separate address spaces etc), but it was possible to enter kernel mode code (CPL=0) from user space code (CPL=3) simply by modifying CR0 register. Instead of raising General Protection Fault, Windows silently allowed it. Also direct I/O was allowed (IN and OUT instructions), as well as CLI and STI instructions (disable/enable interrupts). You could bend system however you like straight from userspace code. If you got interested, look at the source code for Virus.Win9x.CIH for more details and examples.