The Kernel being mapped in userspace isn't actually used in any of the current hacks though. ROhan, the only implemented and public way to get userland Arbitrar

The Kernel being mapped in userspace isn't actually used in any of the current hacks though. ROhan, the only implemented and public way to get userland Arbitrary Code Execution, uses ASLR leaks in both Webkit and SDB. Kernel being mapped in userspace is interesting for save hacks though, which would allow us to escape out of the webkit process (webkit is limited to 700MB of ram, so escaping into a game process is very much interesting). The SMMU bypass is not usable outside of 1.0.0 for Kernel ACE. They have a carveout that denies DMA access to builtins and kernel, the problem is that in 1.0.0, the Kernel would allocate some objects outside of that carveout. It does allow ACE in any other process though.