I wonder if there could be some way to sign a dynamic library to allow it to create direct system calls and then pass that as a kernel command line argument at boot?
Which is a reasonable thing, given that the libc interface is defined by a widely used IEEE standard while the kernel interface is not.