Hyper-V guest-to-host escape operated on Server 2022 Core. Kernel exploit chain stable across nested virt. Seller included PS scripts to auto-disable ETW traces. Procurement team impressed by vendor’s willingness to tweak license for limited one-month engagement.