If I recall correctly, we went through this on Linux in the past. I believe the first wireguard implementations were userspace while the work was being done to get it in the kernel.