A new technique exploits System Management Mode (SMM) using an extremely long-running machine instruction. SMM requires all CPU cores to synchronize—entering or exiting SMM simultaneously. By stalling one core with a single instruction lasting over a second, attackers can cause SMM’s rendezvous timeout to expire, leaving one core outside SMM while others remain inside.

The exploit targets slow MMIO regions, using wide vector loads like `vmovdqu` to read large data sets slowly. On AMD Zen 3 processors, reading from address 0xfcc68860 stalls the CPU long enough to break synchronization.

Researcher Christopher Domas (@xoreaxeaxeax) demonstrated this in his project *smiiiiiiiiiiiiiiii*. He arms per-core SMI counters, fires SMIs via port 0xb2, and checks counter divergence. If cores show inconsistent SMI counts, it proves a core stayed active outside SMM.

This bypasses SMM's core assumption: no code runs during SMM execution. With this method, over 100 dormant SMM TOCTOU vulnerabilities become exploitable from software, without requiring physical access or DMA attacks.