This is very much specific to NT's implementation. Originally they did the right thing and put it in userspace. Performance made them rethink that in NT 4. T

This is very much specific to NT's implementation. Originally they did the right thing and put it in userspace. Performance made them rethink that in NT 4. The NT story is most relevant since the vulnerable version in this story is a descendent of NT not of the DOS/Win 9X lineage. Windows NT is a from scratch rewrite. You are correct GDI as an interface predates NT and protected mode in general, but the codebase used in NT is a different implementation.