I believe you are right -- when attempting to execute a file, the kernel (in the form of the exec family of system calls), opens the file, reads some number of bytes (32 or 256, or whatever), and upon detecting a shebang, copies the command line embodied there, closes the file and builds a new command line using the shebang as the command, with the name of the original file appended and followed by any command-line arguments. The process may repeat as needed until finally some binary is executed, using a command line commensurate with all the preceding steps.

dmm