When exactly .NET Monitor goes to kernel-mode?

Most of these kind of questions can be answered by looking at the CLR source code as available through the SSCLI20 distribution. It is getting pretty dated by now, it is .NET 2.0 vintage, but a lot of the core CLR features haven't changed much.

The source code file you want to look at is clr/src/vm/syncblk.cpp. Three classes play a role here, AwareLock is the low-level lock implementation that takes care of acquiring the lock, SyncBlock is the class that implements the queue of threads that are waiting to enter a lock, CLREvent is the wrapper for the operating system synchronization object, the one you are asking about.

This is C++ code and the level of abstraction is quite high, this code heavily interacts with the garbage collector and there's a lot of testing code included. So I'll give a brief description of the process.

SyncBlock has the m_Monitor member that stores the AwareLock instance. SyncBlock::Enter() directly calls AwareLock::Enter(). It first tries to acquire the lock as cheaply as possible. First checking if the thread already owns the lock and just incrementing the lock count if that's the case. Next using FastInterlockCompareExchange(), an internal function that's very similar to Interlocked.CompareExchange(). If the lock is not contended then this succeeds very quickly and Monitor.Enter() returns. If not then another thread already owns the lock, AwareLock::EnterEpilog is used. There's a need to get the operating system's thread scheduler involved so a CLREvent is used. It is dynamically created if necessary and its WaitOne() method is called. Which will involve a kernel transition.

So enough there to answer your question: the Monitor class enters kernel mode when the lock is contended and the thread has to wait.

When the lock is heavily contended.

If the lock is lightly contended, there is a quick CPU spinlock to wait for the lock to be free again, but if this doesn't wait long enough for the lock to be free, the thread will blocking wait on the mutex, which involves a kernel mode call to suspend the thread and other such management.

After its spinwait step.

additional intelligence may exist, such as skipping spinwait on single core machines since the contested lock could only be released after releasing the thread.