Both IP and AppleTalk stacks are actually in kernel space; netatalk provides application services but doesn't do actual network-level stuff. This made sense when maximum performance was the goal here. Unfortunately, at this point, all this means it that when the Linux people decide to break the kernel AppleTalk stack again, netatalk stops working and there's nothing much anyone can do about it, especially given the rather dodgy attitude towards patches in the Linux kernel.
This, among other reasons, is why, pace some people, I do not believe that netatalk2, especially on Linux, is a feasible middling- or long-term solution to providing network services to older machines.