A Milan0day 2026 writeup walks through a BYOVD-style demo using ThrottleStop.sys and two IOCTLs that the author says expose arbitrary physical memory read and write. The concrete operator hook is the patch-trigger-restore pattern against NtAddAtom, but the post is still self-described demo evidence, not independent validation of broad endpoint bypass impact.