It's all speculative whether a kernel in Rust would or would not have as many bugs as a kernel in C. As for a kernel just ending up as a bunch of unsafe, doesn

It's all speculative whether a kernel in Rust would or would not have as many bugs as a kernel in C. As for a kernel just ending up as a bunch of unsafe, doesn't seem grounded in reality. https://os.phil-opp.com/minimal-rust-kernel/ https://os.phil-opp.com/minimal-rust-kernel/ > Note that there's an unsafe block around all memory writes. The reason is that the Rust compiler can't prove that the raw pointers we create are valid. [..] > I want to emphasize that this is not the way we want to do things in Rust! I [..] > So we want to minimize the use of unsafe as much as possible. Rust gives us the ability to do this by creating safe abstractions. For example, we could create a VGA buffer type that encapsulates all unsafety and ensures that it is impossible to do anything wrong from the outside. This way, we would only need minimal amounts of unsafe and can be sure that we don't violate memory safety. We will create such a safe VGA buffer abstraction in the next post. As is always the response to the "A kernel in rust would be just as unsafe as a kernel in C", the goal is to build safe abstractions. So you have unsafe, plus some constraints that you enforce at a module level, which wraps the unsafety. This is not perfect - you'll still write vulnerable unsafe code, I'm sure, sometimes. But the rest of your code can be built on top of it, and now your unsafe code can be the main target of your testing and verification. We have no real rust kernel the size of Linux to compare to but I think there's plenty of reason to believe that it would have considerably fewer vulnerabilities and would make auditing far simpler.