I don't think it matters for the stub. I chose UserMode because technically Wine always runs in user mode.
That's not really a good reason. The point of ntoskrnl is to emulate kernel mode.
This should probably come from the current thread; perhaps it should just be keyed on PsIsSystemThread(KeGetCurrentThread()). Ideally we'd have at least some tests.