Not to be overly contrary here but, you "need to spray null checks" probably just as much in rust as in C (in this specific example, not in general). Since thos

Not to be overly contrary here but, you "need to spray null checks" probably just as much in rust as in C (in this specific example, not in general). Since those prev/next pointers are being modified in unsafe code where either you're using NonNull::new() which contains the null check, or you're using NonNull::new_unchecked() which means you need to convince yourself all the invariants hold true. The situation is roughly equal in C (ie. once you prove in a module that fields cannot be NULL, no need to add lots of redundant extra NULL checks in all users of the module).