There is two types of memory safety that you talk about there, I think. One is the memory safety that the rust compiler wants to hold and the other is the memo

There is two types of memory safety that you talk about there, I think. One is the memory safety that the rust compiler wants to hold and the other is the memory safety you program into a system. Those can be entirely different with incompatible guarantees, depending on the mission statement of the software. Some things a kernel must do are unsafe for the rust compiler. Dereferencing a null pointer, for example, is basically a crash in most operating system's userland. In kernel space a null pointer may be valid memory that points to real data you need to use. Setting the page tables is unsafe as well; it's almost impossible to guarantee that the following instructions can run in a static manner. You have to validate the page tables you're about to load at runtime and even then the result could be a process crashing.