Right. The OS is a read-only volume, but that's only for when it's being read off the disk into system memory. No reason a patch could not be loaded into both d

Right. The OS is a read-only volume, but that's only for when it's being read off the disk into system memory. No reason a patch could not be loaded into both disk (SSV requiring reboot) and RAM (actively loaded) simultaneously. The kernel would need to approve, but if the kernel approved it could change any memory address it wants. In theory, a Rapid Security Response is not necessarily only an update. It's a Response. It could contain instructions saying, hey, update this file here, and then patch in memory these particular address to specific new values.