All of them. But the remaining question is: how many more would've been introduced by rewriting OpenSSL and OpenVPN in a safe language? I think in the long run

All of them. But the remaining question is: how many more would've been introduced by rewriting OpenSSL and OpenVPN in a safe language? I think in the long run it's probably a good idea to do it, once things have settled a bit and there's a clear "winner" in the safe language front. In the meantime it'll be hard to beat the ubiquity and compatibility of a C library like OpenSSL. OpenVPN on the other hand, as a standalone application, could probably be rewritten right now in Rust, Go or Malbolge if somebody cared enough to do it.