I'm wondering if it is feasible for an OS to return control back to the bootloader, and boot a second OS after itself.
Reason being -- I've been musing on bootkits, and wondering if it would be possible for a bootloader to run a micro-linux distribution hidden at the end of the drive (that charades as a slowly booting Windows install) that, after running its payload, returns control back to Windows boot.
From the point of view of the user, it would just be a very slow boot. It could even be made to look like it's just Windows going through a pre-boot update process.
As far as I can tell, this would just require the hidden malicious OS to be able to pass control back to a bootloader.