Audited hypervisor kernel escapes in regulated environments — Ring 0 is the real attack surface