Ahh, misunderstood your original statement, sorry! And yeah, it should fault; I don't see why they'd run init code in ring0, but win9x did some very strange st

Ahh, misunderstood your original statement, sorry! And yeah, it should fault; I don't see why they'd run init code in ring0, but win9x did some very strange stuff. There was some malware that I'm trying to recall that would rewrite the IDT and then trigger an interrupt, immediately running itself in ring0 -- anyone know which that was? I used to have the assembly sitting around, since it was a fun little virus to analyze.