It has a separate address space separated by PCIe so even escaping the hypervisor won't give access to DPU memory.