Modern Windows is built to load only signed kernel drivers. A driver is signed by a company Microsoft has vouched for — MSI, Intel, ASUS, Dell, Capcom, miHoYo, and so on. That signing process is the gate.

So when a vendor patches a kernel driver — and they do, MSI patched RTCore64, ASUS patched AsIO3, Dell patched the dbutil driver that lived in the wild for over a decade — the patched build replaces the old one only on the machines that actually install the update. The signed old build is still out there. It still loads. And it still does, by design, the same low-level thing it did before: read and write arbitrary kernel memory, talk to hardware ports, peek into processes.

This is what the se…