I am just trying to understand the differences to patching into the kernel and writing a driver.

It is my understanding that a kernel mode driver can do anything the kernel can do, and is similar in some ways to a linux module.

Why then, were AV makers so [upset](http://searchsecurity.techtarget.com/news/interview/0,289202,sid14_gci1235055,00.html) when Microsoft stopped them from patching into the Windows kernel?

What kind of stuff can you do through kernel patching that you can't do through a driver?