So the userspace driver uses the same syscalls or they need to do the work around. I guess I am most interested in the workarounds.
Userspace components are expressly excluded from being considered derived works of the kernel by text at the top of its license. Within the kernel, individual symbols (e.g. function calls) are explicitly tagged with a bit that tells the kernel whether they can be used by non-GPL code, and the kernel checks this at runtime.
Hardware vendors who don't want to open their drivers need to work around these issues. They can either divide the driver into open-source Linux-specific part and closed-source "hardware support library" which avoids calling suspicious kernel APIs, or simply move the whole driver to a userspace shared library and give userspace processes access to the hardware.