eBPF does run in kernel mode.

Maybe better than a module, but I wouldn’t say “the kernel doesn’t include any new code”

It’s also why they have to use “integrity” mode of kernel lockdown

If they used “confidentiality” mode, their eBPF code would be untrusted by the kernel and couldn’t be loaded

That sticker has a serial number, not just a UPC

It’s valid if you try to check its warranty status on their website