[Dwedit]

Some of the Tandy 1000 computers (such as the HX) had MS-DOS 2.11 in ROM. So it's not unheard of for an IBM-Compatible PC to have an operating system in ROM.

Also the "Macintosh Classic" had System 6.0.3 in ROM as well, but you had to use a keyboard shortcut to boot from there. It did not run normally.

[nxobject]

For what it’s worth, a significant proportion of the classic Mac OS’s implementation was in rom anyway - you “upgraded” the OS by patching in-memory jump tables to ROM functions.

[andix]

Are those real ROM-based-systems, that could execute code directly from ROM, without loading it to RAM first?

The only ROM-based-systems I worked with are the Atmel AVR microcontrollers. They don't need to load code into RAM for execution, they have the ROM memory mapped into the address space. I think they can't even run instructions from RAM, which makes remote code execution physically impossible.

[Dwedit]

Even if you can't execute code from RAM, stack corruption and Return-Oriented-Programming (ROP) can still be a thing. It's just far more limited if you can't use ROP to set up regular code.

[kevin_thibedeau]

Memory devices were not accessed via exotic interfaces at the time. ROM was directly addressable on the bus in early PCs. They executed their ROM code directly as the access time was sufficient for low speed clocks. That is what the BIOS is. Any additional OS/BASIC environment worked the same. Later BIOS implementations had shadow RAM options to allow execution without wait states as bus speeds eclipsed ROM access times.

[kevin_thibedeau]

IBM itself made PS/2s with PC-DOS in ROM. The 5150 had ROM BASIC and that also continued through to the early PS/2s.