[danachow]

You are correct, the NT kernel did not allow direct IO access from user space - but there was a commonly used trick of using a small driver (the original one named giveio.sys) that manipulated the IOPL of the TSS through some undocumented kernel functions.