Since I am a visual learner, here is a sequence diagram that helped me follow it a bit cleaner. (yes, I used the gAI dark magic)

```

  sequenceDiagram
      participant HW as Hardware
      participant Kernel as Linux Kernel<br>(USB / driver core / kobject)
      participant NetlinkK as Netlink<br>(NETLINK_KOBJECT_UEVENT<br>group 1 = MONITOR_GROUP_KERNEL)
      participant Udevd as udevd<br>(systemd-udevd)
      participant NetlinkU as Netlink<br>(NETLINK_KOBJECT_UEVENT<br>group 2 = MONITOR_GROUP_UDEV)
      participant App as Userspace Application<br>(libudev or direct netlink listener)
      participant Sysd as systemd<br>(device units, services)
      participant DevFS as /dev<br>(device nodes + symlinks)
  
      HW->>Kernel: Physical insertion (USB plug-in)
  
      Kernel->>Kernel: Detect change via bus/driver<br>(e.g. xhci-hcd → usbcore)
  
      Kernel->>Kernel: Register new device in device model<br>(kobject_add / device_add)
  
      Kernel->>NetlinkK: kobject_uevent_env(ACTION=add, ...)<br>multicast to group 1<br>(raw uevent: null-terminated key=value strings)
  
      NetlinkK->>Udevd: Receive kernel uevent<br>(ACTION=add, SUBSYSTEM=..., DEVPATH=..., etc.)
  
      Note over Udevd: udevd parses uevent
  
      Udevd->>Udevd: Match & apply udev rules<br>(/lib/udev/rules.d/, /etc/udev/rules.d/)
  
      Udevd->>Udevd: Perform actions:<br>• Load firmware<br>• usb_modeswitch<br>• Set permissions<br>• Run programs/scripts
  
      Udevd->>Udevd: Create device node(s)<br>e.g. /dev/bus/usb/001/002
  
      Udevd->>Udevd: Create symlinks<br>e.g. /dev/ttyACM0, /dev/disk/by-id/...
  
      alt Optional: triggers systemd .device unit
          Udevd->>Sysd: Triggers / influences device unit activation
          Sysd->>Sysd: May start dependent services / scopes
      end
  
      Udevd->>Udevd: Build enhanced udev packet:<br>• libudev header ("libudev\0", magic 0xfeedcafe, ...)<br>• MurmurHash2 subsystem/devtype<br>•   64-bit tag Bloom filter<br>• Original + added properties
  
      Udevd->>NetlinkU: Broadcast processed event<br>multicast to group 2<br>(binary format with header + properties)
  
      NetlinkU->>App: Receive udev event packet<br>(via libudev_monitor or raw netlink socket)
  
      App->>App: Parse header, validate magic/credentials<br>Extract properties
  
      App->>App: React to device<br>(open /dev/..., query sysfs, etc.)
  
      Note over DevFS: Device now usable via stable names / permissions