Thanks for confirming! I haven't thought much more about this, but even the "let's confirm that this is indeed a 1:1 identity map" approach seems brittle. And I

Thanks for confirming! I haven't thought much more about this, but even the "let's confirm that this is indeed a 1:1 identity map" approach seems brittle. And I don't know if the first few pages of physical memory are used for anything special on this architecture, but if not, you might run into the (extraordinarily rare) situation where the first 2 virtual pages are regularly mapped to the first 2 physical pages because they were free. Granted, that's a bit like winning the lottery... But all in all, barring any "for some reason"s you mentioned, just properly reading the segment register and going through all motions really seems like the best approach. It's fun what can be inferred from just a few paragraphs in a blog, I hope I didn't fail to take super important details of the architecture into account. :) And good point with the eviction by the OS, I had somehow assumed that the driver was invoking steps to lock those PTEs down, but that may not actually be the case...