The kernel handles the IO. You just don't need to enter the kernel (syscall) to issue it, it is done via a kernel<->user memory mapped ring buffer. Roughly, I don't really know the details well. See https://lwn.net/Articles/743714/
So you don't "ask" the kernel, but pump your data inside a special memory space where the kernel will perform IO with it?
I think the kernel provides results in a special memory space where you can read it without using system calls. Performing operations in the kernel on a memory area writeable by user space sounds really dangerous.
It is possible. As you say, not completely problem free and indeed has raised some discussions regarding security implications. AFAICT documentation is scarce (non-existent).
Here is a previous patch prepping for this one, with sample code to both submit/reap events: https://patchwork.kernel.org/patch/10712819/