Yes, a non privileged instruction can be executed in kernel mode. The procedures executing in kernel mode are permitted (and they are the only ones permitted) to issue privileged instructions. But, as you guessed, the instructions used for transferring control are all non privileged. e.g., RFI (Return from Interrupt) is not privileged, but is executed in privilged mode, which is typically the last instruction executed in an Interrupt Service Routine (ISR).