> Global mutable state is marked as Unsafe in Rust. It's also the simplest way to avoid dynamic allocation and the associated OOM issues. So, short of doing st

> Global mutable state is marked as Unsafe in Rust. It's also the simplest way to avoid dynamic allocation and the associated OOM issues. So, short of doing static analysis to bound heap usage at compile time, that makes things worse. And Toyota already got the static analysis wrong for their stack usage. At least globals will fail to compile if they won't fit.