Drivers protection may be bypassed via subst link to drivers directory (or NtCreateSymbolicLinkObject API).
vulners.com/securityvulns/securityvulns:doc:3930
vulners.com/securityvulns/securityvulns:doc:3931