->readstat() and ->writecmd() are always getting a userland pointer;
marked argument as such, killed "user" flag, killed dead code.