Memory management is also in the kernel (again, because it has to be, you can't share that sort of thing between multiple instances of Mesa, and you have multiple instances of Mesa all the time because the apps often have their own instances rather than going through the X server, for performance reasons). The command stream checker also obviously has to be in the kernel, to protect against a malicious userspace.