[wpm]

As far as I know Little Snitch uses a user-space Network Extension, which uses a public API added by Apple to the OS specifically to help devs move out of kernel space.