> OP is talking about the EEPROM holding code executed by the embedded coprocessor on the NIC Yes, but this coprocessor has access to the host's PCI bus. That

> OP is talking about the EEPROM holding code executed by the embedded coprocessor on the NIC Yes, but this coprocessor has access to the host's PCI bus. That is enough to totally pwn the machine, since it gives read/write access to all memory (well, all memory below 4GB, IIRC, but that's enough.)