You don't need to modify the kernel or iBoot on disk to inject a patched OS (or malware). redsn0w didn't, it would boot over dfu every time.

It's totally possible to rootkit a phone and have it reboot just fine (with the rootkit removed).