"id": "e4c63122-dc63-40dd-8cf0-ef7e82aed103",
Every V86 segment gets the same treatment: access rights 0xE200 (Present, DPL=3, writable data segment), base = selector shifted left by 4, and limit = 64 KB. The microcode loops through all six segment register caches using a counter, applying the same fixed descriptor to each one. This is pure real-mode emulation, enforced at ring 3 with full paging protection underneath.
，详情可参考heLLoword翻译官方下载
На Западе подчинили рой насекомых для разведки в интересах НАТО08:43
The guest runs in a separate virtual address space enforced by the CPU hardware. A bug in the guest kernel cannot access host memory because the hardware prevents it. The host kernel only sees the user-space process. The attack surface is the hypervisor and the Virtual Machine Monitor, both of which are orders of magnitude smaller than the full kernel surface that containers share.