I don't think that's a given, unless you're talking about an untouched dump of c2rust code. In Rust even when using lots of unsafe, it's usually possible to co

I don't think that's a given, unless you're talking about an untouched dump of c2rust code. In Rust even when using lots of unsafe, it's usually possible to compartmentalize/modularize it and build safer, harder-to-misuse interfaces on top of the unsafe code. With this you can test and fuzz one tricky thing at a time, instead of having to prove safety of the combined product. Plus Rust has other features that help with software reliability, like sum types with pattern matching, which are used to make non-nullable types and mandatory error handling, top-notch compiler warnings and lints, and types to describe thread safety. Check out Redox OS — it has lots of unsafe blocks, but mostly safe interfaces between them. Same in Rust for Linux — they're building higher-level building blocks for all the unsafe primitives that Linux requires.