I'm also experimenting with userspace eBPF runtimes to remove the cost of the kernel traps, while also enabling unprivileged mode of xcover.
https://github.com/maxgio92/xcover/tree/userspace
Demo: https://asciinema.org/a/GyzGzTTEP63GJzAG. There's also a demo folder in the repo with a few different use cases. Happy to answer questions about how it finds functions, attaches the probes, or the userspace BPF work.
I gave a talk on this at OpenSouthCode 2026, "The Binary You Ship Is the Binary You Test." Slides are in the repo under docs/talks/opensouthcode-2026, video should be up later.