We used a similar approach when designed the system for video playback for a now-dead mobile phone OS. That had the added requirement of content protection, so user-land should never be able to access video frames, only tell the data plane where to put its data.