i386_iopl. The client/server privsep of cqcam seems adequate, though I wouldn't vouch there is no hole lurking in there...