Riot Anti-Cheat Dev Says Vanguard “Bricking” Panic Is Cheater Fiction After DMA Crackdown

On May 22, 2026, the anti-cheat war stepped out of the machinery room and into the square.

It did not arrive with patch notes arranged neatly in a row, or with a sober engineering brief placed under glass. It arrived with Riot Games’ official X account congratulating the owners of a new “$6k paperweight,” a line sharp enough to carry across the whole market before anyone had agreed what, exactly, had become a paperweight.

The first report had come earlier, on May 19, from anti-cheat watcher ogisadaDMA. Vanguard, Riot’s kernel-level anti-cheat, had reportedly blocked many DMA firmwares using SATA and NVMe paths. The claim was technical, narrow, and dressed in the dry cloth of hardware security: IOMMU warning, DMA firmware, Windows installation, full OS reinstall. It was the sort of thing that belongs in the back room with warm metal, old cables, and people who know which BIOS menu has the dangerous switch.

By the time it reached the public timeline, the story wore armor.

Riot was “bricking PCs.” Clean players were in danger. Vanguard had crossed a line. The old fear of kernel anti-cheat, never very far from the door, came striding back in with its cloak pulled high and a crowd gathering behind it.

Phillip Koskinas, a Riot anti-cheat developer and one of the public faces of Vanguard’s long fight against cheat makers, answered in a way that cut through the shouting precisely because it refused to become grand. In a reply posted May 22 at 16:50 UTC, he addressed the affected users as cheaters, said nothing was bricked, and pointed to the same practical step that, in his telling, had enabled the setup in the first place: turn off IOMMU.

Then he named the shape of the panic. A “great psyop,” he called it, with fiction moving faster than fact.

That is the spine of this story. Not that every player who distrusts kernel anti-cheat is secretly cheating. Not that Vanguard has never caused ordinary players confusion, frustration, or support tickets. The narrower claim is stronger, and it is the one the receipts currently support: this panic appears to have inflated a targeted DMA cheat-hardware enforcement into a normal-player hardware catastrophe.

What Vanguard Appears To Have Hit

The devices at the center of the story are not ordinary keyboards, headsets, or tired SSDs blinking faithfully under a desk. DMA, or Direct Memory Access, cheat setups are expensive hardware paths built to read game memory outside the usual software road, often by presenting themselves as something more innocent than their purpose.

That distinction matters. Without it, the story becomes a fog bank. With it, the shape of the hill appears.

Riot has spent years explaining why DMA attacks matter to Vanguard. In the company’s December 2025 writeup on IOMMU and pre-boot DMA protection, Riot described DMA cards as hardware that can touch system memory directly, bypassing normal operating-system mediation. IOMMU, in that account, is one of the gates meant to keep rogue DMA access from walking freely through memory before the game and anti-cheat can trust what they are seeing.

The May 2026 claim from ogisadaDMA fits that battlefield: Vanguard had blocked many DMA firmwares using SATA/NVMe, triggered an IOMMU restart warning, and made the cheat firmware unusable on that Windows installation unless the user performed a full OS reinstall.

That is not nothing. A full reinstall is not a minor errand. It is an afternoon with a USB stick, backups, drivers, and the unpleasant feeling that the machine is judging you.

But it is still not the same claim as “Riot bricked ordinary PCs.”

Koskinas’ answer presses on that gap. If the affected setup can be addressed by turning off IOMMU the way it was turned on for the cheat device, the damage being described is not a motherboard turned to stone. It is a cheating path losing its route through the system.

The difference is the whole article.

The Bad Headline Version

The word “bricked” did the work of a battering ram.

It took a complicated dispute over DMA firmware, IOMMU behavior, Vanguard enforcement, and Windows recovery, then smashed it into a single image: a normal player pressing launch and finding a dead machine. That image travels well. It fits in quote posts. It lights up old arguments about kernel access. It lets people who already fear Vanguard skip the dull part where the hardware in question has to be named.

Some coverage and community posts leaned into that framing, even while acknowledging the cheat-hardware context below the headline. The result was a story with two layers: the technical layer, where the disputed target is a DMA cheat setup and its ability to operate on a given Windows installation, and the public layer, where “bricked PCs” became the banner carried at the front.

Koskinas’ reply is important because it drags the banner back to the table and asks what it is made of.

There is still a fair criticism of Riot’s messaging. The “$6k paperweight” post was a crowd-pleaser for anyone sick of cheaters, but it also gave anti-Vanguard accounts a bright object to hold up. If an official account uses “paperweight” language around hardware enforcement, people already convinced that Vanguard is malware will not stop to admire the nuance.

That does not make the broader panic true. It means Riot chose a sharp blade in a room full of loose sleeves.

Why DramaLock Cares

This is a Riot and Valorant story first. It is not a Deadlock patch note. It is not a Valve statement. No one should pretend the source thread is secretly about Valve’s game just because the same arguments travel well.

But the pattern matters to DramaLock because Deadlock lives in the same weather.

Competitive communities do not argue about anti-cheat in clean rooms. They argue in crowded halls with old grudges underfoot, where cheaters force developers toward more invasive defenses, invasive defenses create legitimate privacy and stability concerns, and bad-faith actors learn to hide inside those legitimate concerns when enforcement finds them.

The Deadlock discourse has already seen versions of the same chant: kernel anti-cheat is dangerous, developers cannot be trusted, clean players will be punished, and every hard enforcement action proves the system itself is the villain.

Sometimes that scrutiny is necessary. Developers asking for deep system trust should earn it, explain it, and be questioned when things go wrong.

Sometimes the scrutiny is also a cloak thrown over a very expensive advantage that just stopped working.

This incident currently looks much closer to the second version. The clearest primary-source pushback comes from the anti-cheat side, and the technical context points toward DMA cheat setups rather than clean-player machines being destroyed at scale.

The Man Holding The Line

Koskinas’ public role matters here. He is not a random defender riding in from the replies. He is publicly associated with Riot’s anti-cheat work, and older coverage has identified him as a lead figure in Riot’s fight against cheaters. His voice carries the weight of someone who has spent years in the low-ceilinged rooms where cheat developers and anti-cheat developers keep trying to out-wait each other.

That does not make him automatically right on every disputed fact. It does make his reply a primary-source counterweight to the panic version.

The sentence “nothing is bricked” is blunt. The IOMMU instruction is specific. The “psyop” line is the judgment, and it should be treated as his framing rather than a court finding. But the framing has force because it matches the incentive structure. Cheaters caught by a technical measure benefit if the public story becomes “Riot is harming normal players” instead of “Riot found a way to make expensive cheat hardware useless.”

That is the part worth backing.

Not blind faith in a corporation. Not a blank check for kernel anti-cheat. A narrower defense of a developer saying the noisy version of the story is technically wrong, and that the people loudest about “bricking” may have very good reasons to avoid naming the device that stopped working.

What We Can Say

Riot’s “$6k paperweight” post exists and was published on May 21, 2026 at 23:26 UTC.

Koskinas’ reply exists and was published on May 22, 2026 at 16:50 UTC. Twitter MCP capture later that day showed his post at roughly 912 likes and 49 retweets, with engagement still moving.

The originating technical claim from ogisadaDMA said Vanguard blocked many DMA firmwares using SATA/NVMe and triggered an IOMMU restart warning.

Riot has previously documented IOMMU and pre-boot DMA protection as part of Vanguard’s strategy against high-end hardware cheats.

Multiple outlets and community threads picked up the “bricking” framing, but several technically focused replies pushed back that the affected target is not a normal PC. The disputed object is the DMA cheat setup and its ability to keep working on that Windows installation.

What We Should Not Pretend Is Proven

We do not currently have strong public evidence that large numbers of clean, non-cheating players had their ordinary PCs permanently bricked by this Vanguard update.

We also should not flatten every kernel anti-cheat critic into a cheater. Some players have real, long-running objections to Vanguard’s depth in the system. Those concerns exist separately from this specific DMA crackdown.

But on this incident, the dev-side read is the one with the better receipts. The panic around “bricked PCs” appears broader than the actual technical hit, and the loudest version of the story benefits exactly the people who would prefer the public conversation to be about Riot overreach instead of cheat hardware getting caught.

That is why Koskinas’ “fiction faster than fact” line lands. Not because developers should never be questioned, but because cheaters have every incentive to make their enforcement problem look like everybody’s safety problem.

And this time, the paperweight may be less a PC than a narrative that got too heavy to carry.