Some things a driver must do, such as handing a pointer to C or writing to a hardware address, cannot be proven correct by the compiler, so Rust makes you mark that code with the word unsafe. In the kernel, unsafe is not permission to stop thinking: every unsafe block must carry a comment starting with SAFETY that states, in words, why the rules it is trusting actually hold here, and every unsafe function must state what a caller has to guarantee. Reviewers read those comments as the proof, and a patch without them is rejected. This is what keeps a Rust driver auditable: the dangerous code is a small, labelled, searchable minority instead of the whole file.
Every place kernel Rust code steps outside the compiler's guarantees has to carry a written justification directly above it, explaining why that code cannot go wrong. This is separate from the docume…