"The NT kernel, a rewrite in C of the VMS kernel (which itself was written in assembler), presented three APIs to userland: Win32, POSIX, and OS/2." Not quite.

"The NT kernel, a rewrite in C of the VMS kernel (which itself was written in assembler), presented three APIs to userland: Win32, POSIX, and OS/2." Not quite. I'd rephrase this as "NT presented three userland personalities—the CSR (Win32), OS/2, and POSIX—through a composition of kernel primitives implemented as userspace subsystems." The core binary image ntoskrnl.exe only exposes the primitives needed to get the CSR, OS2, and PSX subsystems started, and those (mostly, save for some code that lives in win32k.sys) run in userspace. They more or less act as translators between the native NT ABI/API and the respective subsystems' ABIs/APIs. PSX in particular did a lot of its own PE image mapping and parsing (something that you'd perhaps think would be done in kernel space) so that it could defer to the other subsystems to run foreign code among other things.