What if a process could “mov cr3, 0xdeadface” ?

Note not written yet — to be added.