Essentially the same trick as in L4. Minimal messaging with MMU protection, all syscalls (messages) are blocking, no mailbox per receiver, unlike Mach/Hurd. Their biggest problem.
QNX has much better POSIX support than L4 though. But L4 is open source.