[caf]

The tl;dr is that they're still using the self-referential page table trick, however the PTE_BASE is now randomised at runtime with dynamic fixups.