&gt;  I can reason that the unsafe section has zero side effects outside of it<p>There are basically a core set of invariants that `unsafe` code must hold, and you can reason about it in those terms.<p><a href="http:&#x2F;&#x2F;doc.rust-lang.org&#x2F;nightly&#x2F;nomicon&#x2F;" rel="nofollow">http:&#x2F;&#x2F;doc.rust-lang.org&#x2F;nightly&#x2F;nomicon&#x2F;</a> talks a lot about this.