A NIC company Netronome has had something like this (i.e. running physically on the NIC) as a product for a couple of years now. They have a NIC with lots of proprietary cores that with eBPF can be made to run user code.

To be useful for capture it needed an extra feature, ability to grab a synchronized hardware time counter value, and deliver to a user-space buffer. Writing to user space memory, for kernel bypass, at least once was an underdeveloped eBPF feature; don't know its current condition.