I am confused as to how a process gets virtual address space and then the OS maps the exe and also maps the references to the DLL used for windows api. When the software interrupt occurs the system goes into kernel mode and I would think that the kernel would then load the DLL into memory...but wait, isn't the user process supposed to load the DLL ? How does the reference of the DLL go from user space to loading the DLL in kernel space?