Old VIA C3 chipsets have an undocumented RISC coprocessor that gives you root access from userland if you simply type in four bytes.