WireGuard and OpenVPN both create a TUN device exactly this way to intercept IP packets in user space before encrypting and re-injecting them over a UDP tunnel, while Docker and QEMU networking rely on the TAP variant to bridge Ethernet frames into virtual machines and containers. This is the same kernel interface that lets you build and test a user-space TCP/IP stack without touching kernel code.