I think this is missing the forest for the trees: most of what would normally be a systemcall to the kernel in Linux is instead a capability-based IPC to other

I think this is missing the forest for the trees: most of what would normally be a systemcall to the kernel in Linux is instead a capability-based IPC to other userspace processes with limited privilege. This includes device drivers, the networking stack, filesystems, etc.