[VWWHFSfQ]

is the go userspace program actually shoveling this data or are they in-kernel buffer copies a la sendfile and the like

[wmf]

Yes, userspace has to touch the data to encrypt/decrypt it.