After various attempts to grep for Tss and whatnot, current plan is to just try to binary-search writes to protected memory in the kernel.