For my nfsv4 server, I just use UDP sockets for the upcalls. Since the
stuff I am passing up is already in mbuf(s) { the GSS token }, it works
easily without data copying. I use the same routine as the nfs client
uses for UDP rpc's, tweeked for this case. The userland daemons use
a system call to push the socket into the kernel and only accept requests
from a reserved port# at localhost. (The only case I can think of where
a reserved port# actually means something:-)

If you're interested, the code is sitting in my beta test release for
OpenBSD (hasn't been ported to NetBSD at this time).

I'm not going to say it is a good solution in general, but works fine
for this case. (One nice property it has is that you can have N daemons
listening on different sockets, if you want. This is handy for GSS, since
in some cases of context initialization, you need to continue on from
the previous round of negotiation and the info lives in the runtime
library, etc., so using the same daemon is convenient.)

rick