You might be interested in https://blogs.oracle.com/ksplice/entry/hosting_backdoors_in_... - they show that devices connected to the PCI bus can potentially modify your kernel at boot time, without changing its on-disk signature.