The advantage of putting a layer in kernel space is that you can handle
multiplexing it between several users as well as security issues (eg accepting
reverse change calls in X.25).
You can normally find a line where you can see a clean break. In the case
of appletalk you need only to place the lowest levels of the system in
kernel space and to demux on ports/addresses. The kernel gets to ensure
you use addresses you own, some ports are controlled, the routing table is
handled right and the demux works right. Above that stuff like the AFP
are user libraries.
Its very protocol dependant