Ah, so if I may reiterate, the issues are: 1. Users cannot tell if a device is malicious before authorizing it. 2. Even if the user could tell, the device can

Ah, so if I may reiterate, the issues are: 1. Users cannot tell if a device is malicious before authorizing it. 2. Even if the user could tell, the device can be made malicious post-authorization. Both situations seem like quite universal and unsolvable issues, in that you will never know the exact behavior of a device unless you tear it down atom by atom. (Of course, #2 could be made harder if sub-devices were made part of the authorization, but it will always be possible to make a device malicious given physical access to it, even if a simple PCIe swap is no longer possible.) However, assuming proper fix for the bugs discovered, the IOMMU should make DMA access pointless, reducing any attack to be a simple case of a malicious device that can at most be malicious in the execution of its own functions (e.g. eavesdropping or traffic modification). Why would any peripheral receive device mappings outside of the buffers needed to operate it?