Crowdstrike could have included a BPF interpreter in their driver and used it for all the dangerous logic.