Re: userspace/kernel isolation question

[Gregory Nutt]

But stub call into the real and complex implementation and then the
kernel stack will contain many return address point, the hack can
command kernel write what he want into this region and modify some
return address point to that region, then the kernel will jump to the
code eventually.
That is possible so I am sure that someout out there could be diligent 
enought to make it happen.  There are several chicken'n' egg problems in 
doing it as you describe.