&amp;mut vs. &amp; isn&#x27;t fundamentally about mutability: having unique access (as in &amp;mut) does imply that mutation will be &quot;safe&quot; (as in, act of mutating won&#x27;t cause problems, although it may violate invariants in whatever is being mutated), but types with internal mutability allow safe mutation even when shared (as in &amp;), examples are Cell, RefCell, Mutex and the atomics.<p>Fields wrapped in these types can have invariants that can be violated, e.g.<p><pre><code>  struct Foo {
      must_be_even: Cell&lt;i32&gt;
  }

  impl Foo {
      fn evil(&amp;self) {
          self.must_be_even.set(1); &#x2F;&#x2F; whoops
      }
      
      &#x2F;&#x2F; ... unsafe code that relies on evenness assumption ...
  }
</code></pre>
&gt; So it seems to fix it by hand, one could wrap all the calls which touch instances of this Vec with safe validation code -- basically guard code that runs at runtime to prevent corruptions from spreading<p>Yes, but unfortunately one can&#x27;t always detect the corruption easily&#x2F;cheaply, e.g. there&#x27;s no guarantee of a detectable runtime difference between push_good and push_bad without having to introduce overhead as there&#x27;s no way to look at an arbitrary memory location and tell if it has been initialised or not:<p><pre><code>  &#x2F;&#x2F;&#x2F; Push the value x onto the end of the vector
  fn push_good(&amp;mut self, x: T) {
      &#x2F;&#x2F; need space for one more element
      self.reserve(1); 

      unsafe {
          &#x2F;&#x2F; move x into the space we just reserved
          ptr::write(self.ptr.offset(self.len), x);
      }
      &#x2F;&#x2F; register that there&#x27;s a new element
      self.len += 1;
  }

  &#x2F;&#x2F; just like `evil`
  fn push_bad(&amp;mut self, x: T) {
      self.reserve(1);
      &#x2F;&#x2F; don&#x27;t bother writing `x`, too slow!
      self.len += 1;
  }
</code></pre>
Also, there are various opt-in modes that will try to detect problems in this vein automatically (opt-in because they have non-trivial overhead). For example, debug_assertions mode built into rustc (enables integer overflow checking, and any `debug_assert!`s in libraries), and sanitisers&#x2F;checkers designed for C&#x2F;C++ such as valgrind (works with Rust), TSan and ASan (don&#x27;t yet work).