Riot’s Vanguard update has BSOD cheater hardware after nuking DMA cheat systems

Craig Robinson, Senior Editor

Last Updated: 22/05/2026

Riot Games’ Vanguard anti-cheat has landed one of its most significant blows against cheaters in Valorant. A recent VGK (Riot’s Vanguard Kernel) update has blocked the vast majority of DMA-based (Direct Memory Access) cheats running on SATA and NVMe firmware (storage devices). The result is that the hardware is pretty much entirely blocked, leading to blue-screening issues on devices, and those running them report needing entirely new OS installs to get them operational again.

Riot’s Vanguard eliminates a new way of cheating

Rather than running cheat software on the same PC as the game, DMA cheats use a secondary piece of hardware, typically a PCIe card, to read the game’s memory from an entirely separate device. The cheat software runs on a second computer connected via the DMA card, pulling data like player positions and game state directly from the first PC’s memory without touching the operating system or anything anti-cheat software can scan. It’s part of the reason the software has evaded Vanguard for so long: its kernel-level access normally doesn’t catch it tinkering with the primary PC in that way.

To make the setup work, DMA cards use custom firmware that disguises them as legitimate, unremarkable hardware rather than memory-reading devices. Spoofing that firmware is what the ongoing arms race between cheat developers and anti-cheat teams has largely been fought over.

A hacking journalist named Osisada on X reported the findings in Discord and published them online.

Riot has learned of this method and deployed countermeasures against it. The update triggered IOMMU, a hardware-level security feature built into modern motherboards that controls which devices can access which parts of system memory. When Vanguard detected suspicious DMA activity, it fired an IOMMU restart warning mid-game.

What makes this update particularly damaging is what happens after that trigger. The DMA device becomes permanently non-functional, not just while Valorant is running, but after the game is closed, after Vanguard is uninstalled, and after the PC is restarted. The only way to recover is to reinstall the OS. The firmware is broken at a level that cannot simply be patched around.

People on different boards state responding with glee, while others think Riot frying hardware is a step too far, such as those on the Linux subreddit. It’s the type of intrusion people feared when these deep-kernel-level anti-cheat systems were first introduced.

But Riot’s own anti-cheat staff don’t see it that way. 

This will not end DMA cheating entirely. Firmware developers will attempt to write new variants that avoid triggering the IOMMU detection, and the arms race continues. But permanently bricking hardware rather than just blocking a session raises the cost of cheating considerably. A DMA setup typically costs several hundred dollars. Having that hardware rendered useless by a single anti-cheat update is a meaningful deterrent, whereas an account ban, which can be bypassed with a new account, simply is not.

Hardware bans seem to be becoming more popular as of late, with Forza threatening hardware bans if you pirated Forza 6, for example. 

Maybe you can now grind in your ranked lobby a little bit better, knowing a bunch of cheaters just got their entire systems taken out.

Craig Robinson, Senior Editor

Craig began his career with Esports News UK back in 2015/2016, looking to write about a passion while studying at Manchester Metropolitan University. He stayed there for several years before moving on to other websites to begin his career after graduating. Now he's back, covering esports adjacent topics and UK stories.

All Posts By Craig Robinson