> Vanilla userspace operations shouldn't cause a kernel panic...

The component Crowdstrike says you need to remove to restore functionality is a ".sys" file. That's a kernel-mode driver. The fault is happening on the kernel side.