SMAP Pre-Disarmed: Stack Pivot Exploit Reveals Windows Kernel Design Flaw

The author observed that a stack pivot into user-mode memory on Windows 11 did not trigger Supervisor Mode Access Prevention (SMAP). Experiments revealed that the syscall entry path operates with RFLAGS.AC=1, effectively disabling SMAP for code reached via standard IOCTL dispatch. This behavior aligns with Microsoft’s 2020 documentation, which noted the Windows kernel was not designed with SMAP in mind. The post confirms this architectural limitation through testing.