Yes, and not only no_mangle, but anything that has to do with linking in general can make safe Rust programs unsound (e.g. use LD_PRELOAD to change the malloc i

Yes, and not only no_mangle, but anything that has to do with linking in general can make safe Rust programs unsound (e.g. use LD_PRELOAD to change the malloc implementation at run-time with dynamic linking, and put in a broken/buggt malloc implementation instead). The TL;DR is that safe Rust is only sound, if the safe APIs it uses are sound, which requires their implementations to be sound (Derek Dreyer et al. [0]). That is, the soundness proofs a Rust's compiler gives you only apply to Rust programs with sound unsafe code. If you exchange the malloc implementation with an unsound one, then the soundness proofs the compiler provides just don't apply to your program anymore (they apply only to programs with a sound malloc implementation). --- Being able to worry about soundness in this space is kind of a luxus problem, but probably still one the most interesting aspect of Rust. Like, with C or C++, there is little discussion about soundness because most of the language is already unsound. Like, not even MISRA C tries to make a subset of C sound, just "less dangerous" or "less likely to make mistakes". The big deal of Rust is that it modularizes soundness proofs, allowing users to prove different modules of their program "conditionally sound", e.g., sound _if_ everything they use is also sound. Most Rust code on crates.io is close to 100% safe Rust code, and that code is already "conditionally sound". This means that you only need to manually prove the remaining 1% of the unsafe Rust code correct, which is a much more tractable problem, than trying to prove 100% of the code correct. This allows people to refactor that 1% of the code into tiny modules, that each can be proven correct in isolation, and that allow changes to be more precisely scrutinized. The impact of this is huge. You can refactor pretty much all code you write without worrying about soundness, only needing to worry about it if you need to change one of those tiny modules. [0] http://plv.mpi-sws.org/rustbelt/ http://plv.mpi-sws.org/rustbelt/