Hurd: H2 CD Images
I don't really see why a microkernel can not have access to userland buffers and a monolithic kernel can.
Maybe QNX 4 (different from Neutrino, which is the current QNX) was not very smart, I don't know. And I personally am not hot on message passing either, but QNX remains a good example of message-passing microkernels being to perform relatively good.
But when you say: Because the driver is a user process, it simply can't do the kind of memory mapping that a Unix kernel can do to grab userland data
I would have to disagree. The kernel could easily provide services that would provide memory mapping to the driver. I don't see why not. In fact, with proper protection mechanisms in place there's no reason why any user app should not be able to figure out real memory addresses. I don't think that would be ugly.