tl;dr: Researcher Christopher Domas demonstrates that flipping bits in AMD Family 16h's DRAM controller (MCT/DCT) address-translation registers rewires physical-to-DRAM mappings on the fly, creating aliases that bypass every memory-protection mechanism sitting above the memory controller. Since the scrambling is a GF(2) linear map, an SMT solver like z3 can reconstruct the transform from a few sentinel writes, yielding read/write access to normally fenced regions: PSP/fTPM memory, SMRAM, the C6 idle-state stash, and even live CPU microcode. The technique likely generalizes to Intel, ARM, and RISC-V memory controllers, threatening TEEs like SEV, SGX, TDX, and TrustZone.