Comment by moosingin3space

You can use an IOMMU to isolate DMA to a separate security domain. This is how Qubes OS works.