Retaining sandbox containment despite bugs in privileged memory-safe code. - Justin Cappos; Armon Dadgar; Jeff Rasley; Justin Samuel; Ivan Beschastnikh; Cosmin Barsan; Arvind Krishnamurthy; Thomas E. Anderson (CCS, 2010)