We overcame this with a significant amount of Rust-i-ness and effort in understanding the guts of the kernel and how it implements its assurances. Basically by

We overcame this with a significant amount of Rust-i-ness and effort in understanding the guts of the kernel and how it implements its assurances. Basically by providing setup, resource management, and communication abstractions that you just can't get wrong because doing something dumb that would be entirely nuts and/or would result in difficult to deal with run-time errors (as the kernel enforces some of its guarantees) ends up being rejected by the compiler ahead of time.