Support nightly-2025-10-03

Cargo.toml

···
 name = "relibc"
 version = "0.2.5"
 authors = ["Jeremy Soller <[e-mail]>"]
-edition = "2021"
+edition = "2024"
 
 [lib]
 name = "relibc"

Makefile

···
 $(BUILD)/release/librelibc.a: $(SRC)
 	$(CARGO) rustc --release $(CARGOFLAGS) -- --emit link=$@ $(RUSTCFLAGS)
 	# TODO: Better to only allow a certain whitelisted set of symbols? Perhaps
-	# use some cbindgen hook, specify them manually, or grep for #[no_mangle].
+	# use some cbindgen hook, specify them manually, or grep for #[unsafe(no_mangle)].
 	./renamesyms.sh "$@" "$(BUILD)/release/deps/"
 	touch $@
 

bindgen_transform.sh

···
 sed -i 's/::std::os::raw:://g' $1
-perl -i -p0e 's/extern "C" \{\n    pub fn/#[no_mangle]\npub extern "C" fn/g' $1 
+perl -i -p0e 's/extern "C" \{\n    pub fn/#[unsafe(no_mangle)]\npub extern "C" fn/g' $1 
 perl -i -p0e 's/;\n\}/ {\n    unimplemented!();\n\}\n/g' $1
 rustfmt $1

generic-rt/Cargo.toml

···
 [package]
 name = "generic-rt"
 version = "0.1.0"
-edition = "2021"
+edition = "2024"
 
 [dependencies]

ld_so/Cargo.toml

···
 name = "ld_so"
 version = "0.1.0"
 authors = ["Jeremy Soller <[e-mail]>"]
-edition = "2021"
+edition = "2024"
 
 [lib]
 name = "ld_so"

ld_so/ld_script/aarch64-unknown-redox.ld

···
      *
      * .init_array also depends on TLS and is discarded as we don't need it.
      */
-    *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon)
+    *(.gnu.linkonce.tb.*) *(.tcommon)
     *(.init_array)
   }
 }

ld_so/ld_script/i686-unknown-redox.ld

···
      *
      * .init_array also depends on TLS and is discarded as we don't need it.
      */
-    *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon)
+    *(.gnu.linkonce.tb.*) *(.tcommon)
     *(.init_array)
   }
 }

ld_so/ld_script/riscv64gc-unknown-redox.ld

···
      *
      * .init_array also depends on TLS and is discarded as we don't need it.
      */
-    *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon)
+    *(.gnu.linkonce.tb.*) *(.tcommon)
     *(.init_array)
   }
 }

ld_so/ld_script/x86_64-unknown-linux-gnu.ld

···
      *
      * .init_array also depends on TLS and is discarded as we don't need it.
      */
-    *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon)
+    *(.gnu.linkonce.tb.*) *(.tcommon)
     *(.init_array)
   }
 }

ld_so/ld_script/x86_64-unknown-redox.ld

···
      *
      * .init_array also depends on TLS and is discarded as we don't need it.
      */
-    *(.tbss .tbss.* .gnu.linkonce.tb.*) *(.tcommon)
+    *(.gnu.linkonce.tb.*) *(.tcommon)
     *(.init_array)
   }
 }

ld_so/src/lib.rs

···
 "
 );
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn main(_argc: isize, _argv: *const *const i8) -> usize {
     // LD
     0x1D
 }
 
 #[linkage = "weak"]
-#[no_mangle]
+#[unsafe(no_mangle)]
 extern "C" fn relibc_panic(_pi: &::core::panic::PanicInfo) -> ! {
     loop {}
 }
 
 #[panic_handler]
 #[linkage = "weak"]
-#[no_mangle]
 pub unsafe fn rust_begin_unwind(pi: &::core::panic::PanicInfo) -> ! {
     relibc_panic(pi)
 }

redox-rt/Cargo.toml

···
 name = "redox-rt"
 authors = ["4lDO2 <[e-mail]>"]
 version = "0.1.0"
-edition = "2021"
+edition = "2024"
 license = "MIT"
 description = "Libc-independent runtime for Redox"
 

redox-rt/src/arch/aarch64.rs

···
 use syscall::{data::*, error::*};
 
 use crate::{
-    proc::{fork_inner, FdGuard, ForkArgs},
-    protocol::{ProcCall, RtSigInfo},
-    signal::{inner_c, PosixStackt, RtSigarea, SigStack, PROC_CONTROL_STRUCT},
     RtTcb, Tcb,
+    proc::{FdGuard, ForkArgs, fork_inner},
+    protocol::{ProcCall, RtSigInfo},
+    signal::{PROC_CONTROL_STRUCT, PosixStackt, RtSigarea, SigStack, inner_c},
 };
 
 // Setup a stack starting from the very end of the address space, and then growing downwards.

redox-rt/src/arch/i686.rs

···
 use syscall::*;
 
 use crate::{
-    proc::{fork_inner, FdGuard, ForkArgs},
-    protocol::{ProcCall, RtSigInfo},
-    signal::{inner_fastcall, PosixStackt, RtSigarea, SigStack, PROC_CONTROL_STRUCT},
     RtTcb,
+    proc::{FdGuard, ForkArgs, fork_inner},
+    protocol::{ProcCall, RtSigInfo},
+    signal::{PROC_CONTROL_STRUCT, PosixStackt, RtSigarea, SigStack, inner_fastcall},
 };
 
 // Setup a stack starting from the very end of the address space, and then growing downwards.
···
 
     ret
 "] <= []);
-extern "C" {
+unsafe extern "C" {
     fn __relibc_internal_sigentry_crit_first();
     fn __relibc_internal_sigentry_crit_second();
     fn __relibc_internal_sigentry_crit_third();
···
         flags: 0, // TODO
     }
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe fn manually_enter_trampoline() {
     let c = &crate::Tcb::current().unwrap().os_specific.control;
     c.control_flags.store(

redox-rt/src/arch/riscv64.rs

···
 use core::cell::SyncUnsafeCell;
 
 use crate::{
-    proc::{fork_inner, FdGuard, ForkArgs},
-    protocol::{ProcCall, RtSigInfo},
-    signal::{get_sigaltstack, inner_c, PosixStackt, RtSigarea, SigStack},
     RtTcb, Tcb,
+    proc::{FdGuard, ForkArgs, fork_inner},
+    protocol::{ProcCall, RtSigInfo},
+    signal::{PosixStackt, RtSigarea, SigStack, get_sigaltstack, inner_c},
 };
 use core::{mem::offset_of, ptr::NonNull, sync::atomic::Ordering};
 use syscall::{data::*, error::*};
···
     ", inout("t0") ip_location => _, out("ra") _);
 }
 
-extern "C" {
+unsafe extern "C" {
     fn __relibc_internal_sigentry_crit_first();
     fn __relibc_internal_sigentry_crit_second();
     fn __relibc_internal_sigentry_crit_third();

redox-rt/src/arch/x86_64.rs

···
 };
 
 use crate::{
-    proc::{fork_inner, FdGuard, ForkArgs},
-    protocol::{ProcCall, RtSigInfo},
-    signal::{get_sigaltstack, inner_c, PosixStackt, RtSigarea, SigStack, PROC_CONTROL_STRUCT},
     Tcb,
+    proc::{FdGuard, ForkArgs, fork_inner},
+    protocol::{ProcCall, RtSigInfo},
+    signal::{PROC_CONTROL_STRUCT, PosixStackt, RtSigarea, SigStack, get_sigaltstack, inner_c},
 };
 
 // Setup a stack starting from the very end of the address space, and then growing downwards.
···
     proc_fd = sym PROC_FD,
 ]);
 
-extern "C" {
+unsafe extern "C" {
     fn __relibc_internal_sigentry_crit_first();
     fn __relibc_internal_sigentry_crit_second();
     fn __relibc_internal_sigentry_crit_third();
···
 pub(crate) static SUPPORTS_AVX: AtomicU8 = AtomicU8::new(0);
 
 // __relibc will be prepended to the name, so no_mangle is fine
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe fn manually_enter_trampoline() {
     let c = &Tcb::current().unwrap().os_specific.control;
     c.control_flags.store(

redox-rt/src/lib.rs

···
 
 use core::{
     cell::UnsafeCell,
-    mem::{size_of, MaybeUninit},
+    mem::{MaybeUninit, size_of},
 };
 
 use generic_rt::{ExpectTlsFree, GenericTcb};
···
             .size ", stringify!($name), ", . - ", stringify!($name), "
         "), $($decl = $(sym $symname)?$(const $constval)?),*);
 
-        extern "C" {
+        unsafe extern "C" {
             pub fn $name($($(_: $arg),*)?) $(-> $ret)?;
         }
     }

redox-rt/src/proc.rs

···
 use core::{
     cell::SyncUnsafeCell,
     fmt::Debug,
-    mem::{size_of, MaybeUninit},
+    mem::{MaybeUninit, size_of},
 };
 
 use crate::{
+    DYNAMIC_PROC_INFO, RtTcb, StaticProcInfo,
     arch::*,
     auxv_defs::*,
     protocol::{ProcCall, ThreadCall},
     read_proc_meta,
     sys::{proc_call, thread_call},
-    RtTcb, StaticProcInfo, DYNAMIC_PROC_INFO,
 };
 
 use alloc::{boxed::Box, collections::BTreeMap, vec};
···
 #[cfg(target_pointer_width = "32")]
 use goblin::elf32::{
     header::Header,
-    program_header::program_header32::{ProgramHeader, PF_R, PF_W, PF_X, PT_INTERP, PT_LOAD},
+    program_header::program_header32::{PF_R, PF_W, PF_X, PT_INTERP, PT_LOAD, ProgramHeader},
 };
 #[cfg(target_pointer_width = "64")]
 use goblin::elf64::{
     header::Header,
-    program_header::program_header64::{ProgramHeader, PF_R, PF_W, PF_X, PT_INTERP, PT_LOAD},
+    program_header::program_header64::{PF_R, PF_W, PF_X, PT_INTERP, PT_LOAD, ProgramHeader},
 };
 
 use syscall::{
+    CallFlags, GrantDesc, GrantFlags, MAP_FIXED_NOREPLACE, MAP_SHARED, Map, PAGE_SIZE, PROT_EXEC,
+    PROT_READ, PROT_WRITE, SetSighandlerData,
     error::*,
     flag::{MapFlags, SEEK_SET},
-    CallFlags, GrantDesc, GrantFlags, Map, SetSighandlerData, MAP_FIXED_NOREPLACE, MAP_SHARED,
-    PAGE_SIZE, PROT_EXEC, PROT_READ, PROT_WRITE,
 };
 
 pub enum FexecResult {

redox-rt/src/signal.rs

···
 use core::{ffi::c_int, ptr::NonNull, sync::atomic::Ordering};
 
 use syscall::{
-    data::AtomicU64, CallFlags, Error, RawAction, Result, SenderInfo, SetSighandlerData,
-    SigProcControl, Sigcontrol, SigcontrolFlags, TimeSpec, EAGAIN, EINTR, EINVAL, ENOMEM, EPERM,
+    CallFlags, EAGAIN, EINTR, EINVAL, ENOMEM, EPERM, Error, RawAction, Result, SenderInfo,
+    SetSighandlerData, SigProcControl, Sigcontrol, SigcontrolFlags, TimeSpec, data::AtomicU64,
 };
 
 use crate::{
+    RtTcb, Tcb,
     arch::*,
     current_proc_fd,
     proc::FdGuard,
     protocol::{
-        ProcCall, RtSigInfo, ThreadCall, SIGCHLD, SIGCONT, SIGKILL, SIGSTOP, SIGTSTP, SIGTTIN,
-        SIGTTOU, SIGURG, SIGWINCH,
+        ProcCall, RtSigInfo, SIGCHLD, SIGCONT, SIGKILL, SIGSTOP, SIGTSTP, SIGTTIN, SIGTTOU, SIGURG,
+        SIGWINCH, ThreadCall,
     },
     static_proc_info,
     sync::Mutex,
     sys::{proc_call, this_thread_call},
-    RtTcb, Tcb,
 };
 
 #[cfg(target_arch = "x86_64")]
···
             (area.tmp_rt_inf.pid, area.tmp_rt_inf.uid)
         } else {
             stack.sig_code = 0; // TODO: SI_USER constant?
-                                // TODO: Handle SIGCHLD. Maybe that should always be queued though?
+            // TODO: Handle SIGCHLD. Maybe that should always be queued though?
             let inf = SenderInfo::from_raw(area.tmp_id_inf);
             (inf.pid, inf.ruid)
         }
···
     res?;
     unreachable!()
 }
-/*#[no_mangle]
+/*#[unsafe(no_mangle)]
 pub extern "C" fn __redox_rt_debug_sigctl() {
     let tcb = &RtTcb::current().control;
     let _ = syscall::write(1, alloc::format!("SIGCTL: {tcb:#x?}\n").as_bytes());

redox-rt/src/sys.rs

···
 };
 
 use syscall::{
-    error::{self, Error, Result, EINTR},
-    CallFlags, TimeSpec, EINVAL, ERESTART,
+    CallFlags, EINVAL, ERESTART, TimeSpec,
+    error::{self, EINTR, Error, Result},
 };
 
 use crate::{
+    DYNAMIC_PROC_INFO, DynamicProcInfo, RtTcb, Tcb,
     arch::manually_enter_trampoline,
     protocol::{ProcCall, ProcKillTarget, RtSigInfo, ThreadCall, WaitFlags},
     read_proc_meta,
     signal::tmp_disable_signals,
-    DynamicProcInfo, RtTcb, Tcb, DYNAMIC_PROC_INFO,
 };
 
 #[inline]

redox-rt/src/thread.rs

···
 
 use syscall::Result;
 
-use crate::{arch::*, proc::*, signal::tmp_disable_signals, static_proc_info, RtTcb};
+use crate::{RtTcb, arch::*, proc::*, signal::tmp_disable_signals, static_proc_info};
 
 /// Spawns a new context sharing the same address space as the current one (i.e. a new thread).
 pub unsafe fn rlct_clone_impl(stack: *mut usize) -> Result<FdGuard> {

rust-toolchain.toml

···
 [toolchain]
-channel = "nightly-2025-01-12"
+channel = "nightly-2025-10-03"
 components = ["rust-src"]

rustfmt.toml

···
 blank_lines_upper_bound = 1
 brace_style = "SameLineWhere"
 disable_all_formatting = false
-edition = "2018"
+edition = "2024"
 empty_item_single_line = true
 fn_single_line = false
 force_explicit_abi = true

src/c_vec.rs

···
 
 use crate::{
     io::{self, Write},
-    platform::{self, types::*, WriteByte},
+    platform::{self, WriteByte, types::*},
 };
 use core::{
     cmp, fmt,

src/crt0/Cargo.toml

···
 name = "crt0"
 version = "0.1.0"
 authors = ["Jeremy Soller <[e-mail]>"]
-edition = "2021"
+edition = "2024"
 
 [lib]
 name = "crt0"

src/crt0/src/lib.rs

···
 "
 );
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn relibc_crt0(sp: usize) -> ! {
     // This wrapper ensures a dynamic libc.so can access a hidden main function
     //TODO: common definition of types
-    extern "C" {
+    unsafe extern "C" {
         fn main(argc: isize, argv: *mut *mut c_char, envp: *mut *mut c_char) -> c_int;
         fn relibc_start_v1(
             sp: usize,
···
 }
 
 #[linkage = "weak"]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn relibc_panic(_pi: &::core::panic::PanicInfo) -> ! {
     loop {}
 }
 
 #[panic_handler]
 #[linkage = "weak"]
-#[no_mangle]
 pub unsafe fn rust_begin_unwind(pi: &::core::panic::PanicInfo) -> ! {
     relibc_panic(pi)
 }

src/crti/Cargo.toml

···
 name = "crti"
 version = "0.1.0"
 authors = ["jD91mZM2 <[e-mail]>"]
-edition = "2021"
+edition = "2024"
 
 [lib]
 name = "crti"

src/crti/src/lib.rs

···
 // risc-v has no _init / _fini functions; it exclusively uses init/fini arrays
 
 #[linkage = "weak"]
-#[no_mangle]
+#[unsafe(no_mangle)]
 extern "C" fn relibc_panic(_pi: &::core::panic::PanicInfo) -> ! {
     loop {}
 }
 
 #[panic_handler]
 #[linkage = "weak"]
-#[no_mangle]
 pub unsafe fn rust_begin_unwind(pi: &::core::panic::PanicInfo) -> ! {
     relibc_panic(pi)
 }

src/crtn/Cargo.toml

···
 name = "crtn"
 version = "0.1.0"
 authors = ["jD91mZM2 <[e-mail]>"]
-edition = "2021"
+edition = "2024"
 
 [lib]
 name = "crtn"

src/crtn/src/lib.rs

···
 // risc-v has no _init / _fini functions; it exclusively uses init/fini arrays
 
 #[linkage = "weak"]
-#[no_mangle]
+#[unsafe(no_mangle)]
 extern "C" fn relibc_panic(_pi: &::core::panic::PanicInfo) -> ! {
     loop {}
 }
 
 #[panic_handler]
 #[linkage = "weak"]
-#[no_mangle]
 pub unsafe fn rust_begin_unwind(pi: &::core::panic::PanicInfo) -> ! {
     relibc_panic(pi)
 }

src/cxa.rs

···
-use crate::platform::types::*;
+use crate::{platform::types::*, raw_cell::RawCell};
 
 // TODO: Implement cxa_finalize and uncomment this
 
···
     //dso: *mut c_void,
 }
 
-static mut CXA_ATEXIT_FUNCS: [Option<CxaAtExitFunc>; 32] = [None; 32];
+static CXA_ATEXIT_FUNCS: RawCell<[Option<CxaAtExitFunc>; 32]> = RawCell::new([None; 32]);
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn __cxa_atexit(
     func_opt: Option<extern "C" fn(*mut c_void)>,
     arg: *mut c_void,
     dso: *mut c_void,
 ) -> c_int {
-    for item in &mut CXA_ATEXIT_FUNCS {
-        if item.is_none() {
-            *item = func_opt.map(|func| CxaAtExitFunc {} /*{ func, arg, dso }*/);
+    for i in 0..CXA_ATEXIT_FUNCS.unsafe_ref().len() {
+        if CXA_ATEXIT_FUNCS.unsafe_ref()[i].is_none() {
+            CXA_ATEXIT_FUNCS.unsafe_mut()[i] =
+                func_opt.map(|func| CxaAtExitFunc {} /*{ func, arg, dso }*/);
             return 0;
         }
     }

src/fs.rs

···
         unistd::{SEEK_CUR, SEEK_END, SEEK_SET},
     },
     io,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 use core::ops::Deref;
 

src/header/_aio/mod.rs

···
     pub aio_sigevent: sigevent,
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn aio_read(aiocbp: *mut aiocb) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn aio_write(aiocbp: *mut aiocb) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn lio_listio(
     mode: c_int,
     list: *const *const aiocb,
···
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn aio_error(aiocbp: *const aiocb) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn aio_return(aiocbp: *mut aiocb) -> usize {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn aio_cancel(fildes: c_int, aiocbp: *mut aiocb) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn aio_suspend(
     list: *const *const aiocb,
     nent: c_int,
···
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn aio_fsync(operation: c_int, aiocbp: *mut aiocb) -> c_int {
     unimplemented!();
 }

src/header/_fenv/mod.rs

···
     pub cw: u64,
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn feclearexcept(excepts: c_int) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn fegenenv(envp: *mut fenv_t) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn fegetexceptflag(flagp: *mut fexcept_t, excepts: c_int) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn fegetround() -> c_int {
     FE_TONEAREST
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn feholdexcept(envp: *mut fenv_t) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn feraiseexcept(except: c_int) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn fesetenv(envp: *const fenv_t) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn fesetexceptflag(flagp: *const fexcept_t, excepts: c_int) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn fesetround(round: c_int) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn fetestexcept(excepts: c_int) -> c_int {
     unimplemented!();
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn feupdateenv(envp: *const fenv_t) -> c_int {
     unimplemented!();
 }

src/header/_template/mod.rs

···
 use platform::types::*;
 
 /*
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn func(args) -> c_int {
     unimplemented!();
 }

src/header/arch_aarch64_user/mod.rs

···
 pub type elf_gregset_t = [c_ulong; 34];
 pub type elf_fpregset_t = user_fpsimd_struct;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn _cbindgen_export_aarch64_user(
     a: user_regs_struct,
     b: user_fpsimd_struct,

src/header/arch_riscv64_user/mod.rs

···
 pub type elf_gregset_t = user_regs_struct;
 pub type elf_fpregset_t = user_fpregs_struct;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn _cbindgen_only_generates_structs_if_they_are_mentioned_which_is_dumb_riscv64_user(
     a: user_regs_struct,
     b: user_fpregs_struct,

src/header/arch_x64_user/mod.rs

···
     pub u_debugreg: [c_ulong; 8],
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn _cbindgen_export_x86_user(
     a: user_fpregs_struct,
     b: user_regs_struct,

src/header/arpa_inet/mod.rs

···
     c_str::CStr,
     header::{
         errno::*,
-        netinet_in::{in_addr, in_addr_t, ntohl, INADDR_NONE},
+        netinet_in::{INADDR_NONE, in_addr, in_addr_t, ntohl},
         sys_socket::{constants::*, socklen_t},
     },
     platform::{self, types::*},
+    raw_cell::RawCell,
 };
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/inet_addr.html>.
···
 /// The `inet_addr()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 8.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn inet_addr(cp: *const c_char) -> in_addr_t {
     let mut val: in_addr = in_addr { s_addr: 0 };
 
···
 }
 
 /// Non-POSIX, see <https://www.man7.org/linux/man-pages/man3/inet_aton.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn inet_aton(cp: *const c_char, inp: *mut in_addr) -> c_int {
     // TODO: octal/hex
     unsafe { inet_pton(AF_INET, cp, inp as *mut c_void) }
···
 /// The `inet_lnaof()` function was specified in Networking Services Issue 5,
 /// but not in the Open Group Base Specifications Issue 6 and later.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn inet_lnaof(r#in: in_addr) -> in_addr_t {
     if r#in.s_addr >> 24 < 128 {
         r#in.s_addr & 0xff_ffff
···
 /// The `inet_makeaddr()` function was specified in Networking Services Issue
 /// 5, but not in the Open Group Base Specifications Issue 6 and later.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn inet_makeaddr(net: in_addr_t, lna: in_addr_t) -> in_addr {
     let mut output: in_addr = in_addr { s_addr: 0 };
 
···
 /// The `inet_netof()` function was specified in Networking Services Issue 5,
 /// but not in the Open Group Base Specifications Issue 6 and later.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn inet_netof(r#in: in_addr) -> in_addr_t {
     if r#in.s_addr >> 24 < 128 {
         r#in.s_addr & 0xff_ffff
···
 /// The `inet_network()` function was specified in Networking Services Issue 5,
 /// but not in the Open Group Base Specifications Issue 6 and later.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn inet_network(cp: *const c_char) -> in_addr_t {
     ntohl(unsafe { inet_addr(cp) })
 }
···
 /// The `inet_ntoa()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 8.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn inet_ntoa(r#in: in_addr) -> *const c_char {
-    static mut NTOA_ADDR: [c_char; 16] = [0; 16];
+    static NTOA_ADDR: RawCell<[c_char; 16]> = RawCell::new([0; 16]);
 
     unsafe {
         inet_ntop(
             AF_INET,
             &r#in as *const in_addr as *const c_void,
-            NTOA_ADDR.as_mut_ptr(),
-            16,
+            NTOA_ADDR.unsafe_mut().as_mut_ptr(),
+            NTOA_ADDR.unsafe_ref().len(),
         )
     }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/inet_ntop.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn inet_ntop(
     af: c_int,
     src: *const c_void,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/inet_ntop.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn inet_pton(af: c_int, src: *const c_char, dst: *mut c_void) -> c_int {
     if af != AF_INET {
         platform::ERRNO.set(EAFNOSUPPORT);

src/header/assert/mod.rs

···
 
 use crate::{c_str::CStr, platform::types::*};
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn __assert_fail(
     func: *const c_char,
     file: *const c_char,

src/header/crypt/argon2.rs

···
 use alloc::string::{String, ToString};
 use argon2::{
-    password_hash::{PasswordHash, PasswordVerifier},
     Argon2,
+    password_hash::{PasswordHash, PasswordVerifier},
 };
 
 pub fn crypt_argon2(key: &str, setting: &str) -> Option<String> {

src/header/crypt/mod.rs

···
     string::{String, ToString},
 };
 use core::ptr;
-use rand::{rngs::SmallRng, RngCore, SeedableRng};
+use rand::{RngCore, SeedableRng, rngs::SmallRng};
 
 use crate::{
     c_str::CStr,
···
     md5::crypt_md5,
     pbkdf2::crypt_pbkdf2,
     scrypt::crypt_scrypt,
-    sha::{crypt_sha, ShaType::*},
+    sha::{ShaType::*, crypt_sha},
 };
 
 /// See <https://www.man7.org/linux/man-pages/man3/crypt.3.html>.
···
 }
 
 /// See <https://www.man7.org/linux/man-pages/man3/crypt.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn crypt_r(
     key: *const c_char,
     setting: *const c_char,

src/header/crypt/scrypt.rs

···
 use alloc::string::{String, ToString};
 use base64ct::{Base64Bcrypt, Encoding};
 use core::{str, u32};
-use scrypt::{scrypt, Params};
+use scrypt::{Params, scrypt};
 
 /// Map for encoding and decoding
 #[inline(always)]

src/header/crypt/sha.rs

···
 use alloc::string::{String, ToString};
 
 use sha_crypt::{
-    sha256_crypt_b64, sha512_crypt_b64, Sha256Params, Sha512Params, ROUNDS_DEFAULT, ROUNDS_MAX,
-    ROUNDS_MIN,
+    ROUNDS_DEFAULT, ROUNDS_MAX, ROUNDS_MIN, Sha256Params, Sha512Params, sha256_crypt_b64,
+    sha512_crypt_b64,
 };
 
 use crate::platform::types::*;

src/header/ctype/mod.rs

···
 use crate::platform::types::*;
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/isalnum.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn isalnum(c: c_int) -> c_int {
     c_int::from(isdigit(c) != 0 || isalpha(c) != 0)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/isalpha.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn isalpha(c: c_int) -> c_int {
     c_int::from(islower(c) != 0 || isupper(c) != 0)
 }
···
 /// The `isascii()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 7, and removed in Issue 8.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn isascii(c: c_int) -> c_int {
     c_int::from((c & !0x7f) == 0)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/isblank.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn isblank(c: c_int) -> c_int {
     c_int::from(c == c_int::from(b' ') || c == c_int::from(b'\t'))
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iscntrl.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iscntrl(c: c_int) -> c_int {
     c_int::from((c >= 0x00 && c <= 0x1f) || c == 0x7f)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/isdigit.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn isdigit(c: c_int) -> c_int {
     c_int::from(c >= c_int::from(b'0') && c <= c_int::from(b'9'))
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/isgraph.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn isgraph(c: c_int) -> c_int {
     c_int::from(c >= 0x21 && c <= 0x7e)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/islower.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn islower(c: c_int) -> c_int {
     c_int::from(c >= c_int::from(b'a') && c <= c_int::from(b'z'))
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/isprint.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn isprint(c: c_int) -> c_int {
     c_int::from(c >= 0x20 && c < 0x7f)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/ispunct.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn ispunct(c: c_int) -> c_int {
     c_int::from(
         (c >= c_int::from(b'!') && c <= c_int::from(b'/'))
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/isspace.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn isspace(c: c_int) -> c_int {
     c_int::from(
         c == c_int::from(b' ')
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/isupper.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn isupper(c: c_int) -> c_int {
     c_int::from(c >= c_int::from(b'A') && c <= c_int::from(b'Z'))
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/isxdigit.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn isxdigit(c: c_int) -> c_int {
     c_int::from(isdigit(c) != 0 || (c | 32 >= c_int::from(b'a') && c | 32 <= c_int::from(b'f')))
 }
···
 /// The `toascii()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 7, and removed in Issue 8.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn toascii(c: c_int) -> c_int {
     c & 0x7f
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/tolower.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn tolower(c: c_int) -> c_int {
-    if isupper(c) != 0 {
-        c | 0x20
-    } else {
-        c
-    }
+    if isupper(c) != 0 { c | 0x20 } else { c }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/toupper.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn toupper(c: c_int) -> c_int {
-    if islower(c) != 0 {
-        c & !0x20
-    } else {
-        c
-    }
+    if islower(c) != 0 { c & !0x20 } else { c }
 }

src/header/dirent/mod.rs

···
     fs::File,
     header::{fcntl, stdlib, string},
     out::Out,
-    platform::{self, types::*, Pal, Sys},
+    platform::{self, Pal, Sys, types::*},
 };
 
 use super::{
···
 };
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/alphasort.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn alphasort(first: *mut *const dirent, second: *mut *const dirent) -> c_int {
     unsafe { string::strcoll((**first).d_name.as_ptr(), (**second).d_name.as_ptr()) }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/closedir.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn closedir(dir: Box<DIR>) -> c_int {
     dir.close().map(|()| 0).or_minus_one_errno()
 }
···
 /// FreeBSD extension that transfers ownership of the directory file descriptor to the user.
 ///
 /// It doesn't matter if DIR was opened with [`opendir`] or [`fdopendir`].
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn fdclosedir(dir: Box<DIR>) -> c_int {
     let mut file = dir.file;
     file.reference = true;
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/dirfd.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn dirfd(dir: &mut DIR) -> c_int {
     *dir.file
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/fdopendir.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn opendir(path: *const c_char) -> *mut DIR {
     let path = unsafe { CStr::from_ptr(path) };
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/fdopendir.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn fdopendir(fd: c_int) -> *mut DIR {
     DIR::from_fd(fd).or_errno_null_mut()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/posix_getdents.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn posix_getdents(
     fildes: c_int,
     buf: *mut c_void,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/readdir.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn readdir(dir: &mut DIR) -> *mut dirent {
     dir.next_dirent().or_errno_null_mut()
 }
···
 /// The `readdir_r()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 8.
 #[deprecated]
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn readdir_r(
     _dir: *mut DIR,
     _entry: *mut dirent,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/rewinddir.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn rewinddir(dir: &mut DIR) {
     dir.rewind();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/alphasort.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn scandir(
     dirp: *const c_char,
     namelist: *mut *mut *mut dirent,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/seekdir.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn seekdir(dir: &mut DIR, off: c_long) {
     dir.seek(
         off.try_into()
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/telldir.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn telldir(dir: &mut DIR) -> c_long {
     dir.opaque_offset as c_long
 }

src/header/dl-tls/mod.rs

···
     pub ti_offset: usize,
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn __tls_get_addr(ti: *mut dl_tls_index) -> *mut c_void {
     let tcb = unsafe { Tcb::current().unwrap() };
     let ti = unsafe { &*ti };

src/header/dlfcn/mod.rs

···
     dli_saddr: *mut c_void,
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn dladdr(_addr: *mut c_void, info: *mut Dl_info) -> c_int {
     //TODO
     unsafe {
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn dlopen(cfilename: *const c_char, flags: c_int) -> *mut c_void {
     //TODO support all sort of flags
     let resolve = if flags & RTLD_NOW == RTLD_NOW {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn dlsym(handle: *mut c_void, symbol: *const c_char) -> *mut c_void {
     let handle = ObjectHandle::from_ptr(handle);
 
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn dlclose(handle: *mut c_void) -> c_int {
     let tcb = match unsafe { Tcb::current() } {
         Some(tcb) => tcb,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn dlerror() -> *mut c_char {
     ERROR.swap(0, Ordering::SeqCst) as *mut c_char
 }

src/header/elf/mod.rs

···
 pub const R_X86_64_RELATIVE64: usize = 38;
 pub const R_X86_64_NUM: usize = 39;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn _cbindgen_export_elf(
     a: Elf32_Ehdr,
     b: Elf64_Ehdr,

src/header/endian/mod.rs

···
 use crate::platform::types::*;
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/be16toh.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn be16toh(x: uint16_t) -> uint16_t {
     uint16_t::from_be(x)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/be16toh.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn be32toh(x: uint32_t) -> uint32_t {
     uint32_t::from_be(x)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/be16toh.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn be64toh(x: uint64_t) -> uint64_t {
     uint64_t::from_be(x)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/be16toh.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn htobe16(x: uint16_t) -> uint16_t {
     x.to_be()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/be16toh.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn htobe32(x: uint32_t) -> uint32_t {
     x.to_be()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/be16toh.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn htobe64(x: uint64_t) -> uint64_t {
     x.to_be()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/be16toh.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn htole16(x: uint16_t) -> uint16_t {
     x.to_le()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/be16toh.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn htole32(x: uint32_t) -> uint32_t {
     x.to_le()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/be16toh.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn htole64(x: uint64_t) -> uint64_t {
     x.to_le()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/be16toh.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn le16toh(x: uint16_t) -> uint16_t {
     uint16_t::from_le(x)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/be16toh.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn le32toh(x: uint32_t) -> uint32_t {
     uint32_t::from_le(x)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/be16toh.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn le64toh(x: uint64_t) -> uint64_t {
     uint64_t::from_le(x)
 }

src/header/err/mod.rs

···
 #![allow(unsafe_op_in_unsafe_fn)]
 
 use core::{
-    ffi::{c_char, c_int, VaList as va_list},
+    ffi::{VaList as va_list, c_char, c_int},
     ptr,
 };
 
 use crate::{
     c_str::CStr,
     header::{
-        stdio::{self, fprintf, fputc, fputs, vfprintf, FILE},
+        stdio::{self, FILE, fprintf, fputc, fputs, vfprintf},
         stdlib::exit,
         string::strerror,
     },
···
 static mut error_sink: *mut FILE = ptr::null_mut();
 
 /// Set global [`FILE`] sink to write errors and warnings.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn err_set_file(fp: *mut FILE) {
     if fp.is_null() {
         error_sink = stdio::stderr;
···
 }
 
 /// Set or remove a callback to invoke before exiting on error.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn err_set_exit(ef: ExitCallback) {
     on_exit = ef;
 }
···
 ///
 /// # Return
 /// Does not return. Exits with `eval` as an error code.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn err(eval: c_int, fmt: *const c_char, mut va_list: ...) -> ! {
     let code = Some(ERRNO.get());
     err_exit(eval, code, fmt, va_list.as_va_list())
···
 ///
 /// # Return
 /// Exits with `eval` as an error code.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn errc(eval: c_int, code: c_int, fmt: *const c_char, mut va_list: ...) -> ! {
     err_exit(eval, Some(code), fmt, va_list.as_va_list())
 }
···
 ///
 /// # Return
 /// Exits with `eval` as an error code.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn errx(eval: c_int, fmt: *const c_char, mut va_list: ...) -> ! {
     err_exit(eval, None, fmt, va_list.as_va_list())
 }
···
 /// Print a user message and then an error message for [`ERRNO`].
 ///
 /// The message format is `progname: fmt: strerror(ERRNO)`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn warn(fmt: *const c_char, mut va_list: ...) {
     let code = Some(ERRNO.get());
     display_message(code, fmt, va_list.as_va_list());
···
 /// Print a user message then an error message for `code`.
 ///
 /// The message format is `progname: fmt: strerror(code)`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn warnc(code: c_int, fmt: *const c_char, mut va_list: ...) {
     display_message(Some(code), fmt, va_list.as_va_list());
 }
···
 /// Print a user message as a warning.
 ///
 /// The message format is `progname: fmt`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn warnx(fmt: *const c_char, mut va_list: ...) {
     display_message(None, fmt, va_list.as_va_list());
 }
 
 /// See [`err`].
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn verr(eval: c_int, fmt: *const c_char, args: va_list) -> ! {
     let code = Some(ERRNO.get());
     err_exit(eval, code, fmt, args);
 }
 
 /// See [`errc`].
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn verrc(eval: c_int, code: c_int, fmt: *const c_char, args: va_list) -> ! {
     err_exit(eval, Some(code), fmt, args)
 }
 
 /// See [`errx`];
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn verrx(eval: c_int, fmt: *const c_char, args: va_list) -> ! {
     err_exit(eval, None, fmt, args)
 }
 
 /// See [`warn`].
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vwarn(fmt: *const c_char, args: va_list) {
     let code = Some(ERRNO.get());
     display_message(code, fmt, args);
 }
 
 /// See [`warnc`].
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vwarnc(code: c_int, fmt: *const c_char, args: va_list) {
     display_message(Some(code), fmt, args);
 }
 
 /// See [`warnx`].
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vwarnx(fmt: *const c_char, args: va_list) {
     display_message(None, fmt, args);
 }

src/header/errno/mod.rs

···
 use crate::platform::{self, types::*};
 
 //TODO: Consider removing, provided for compatibility with newlib
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn __errno() -> *mut c_int {
     __errno_location()
 }
···
 ///
 /// This is the basis of the C-facing macro definition of `errno`, and should
 /// not be used directly.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn __errno_location() -> *mut c_int {
     platform::ERRNO.as_ptr()
 }
···
 /// `program_invocation_name`, and should not be used directly.
 ///
 /// The `program_invocation_name` variable is a GNU extension.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn __program_invocation_name() -> *mut *mut c_char {
-    unsafe { &mut platform::program_invocation_name }
+    unsafe { &raw mut platform::program_invocation_name }
 }
 
 /// Get the directory-less name used to invoke the program.
···
 /// `program_invocation_short_name`, and should not be used directly.
 ///
 /// The `program_invocation_short_name` variable is a GNU extension.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn __program_invocation_short_name() -> *mut *mut c_char {
-    unsafe { &mut platform::program_invocation_short_name }
+    unsafe { &raw mut platform::program_invocation_short_name }
 }
 
 pub const EPERM: c_int = 1; /* Operation not permitted */

src/header/fcntl/mod.rs

···
 use crate::{
     c_str::CStr,
     error::ResultExt,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 
 pub use self::sys::*;
···
 pub const F_TLOCK: c_int = 2;
 pub const F_TEST: c_int = 3;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn creat(path: *const c_char, mode: mode_t) -> c_int {
     unsafe { open(path, O_WRONLY | O_CREAT | O_TRUNC, mode) }
 }
···
     pub l_len: off_t,
     pub l_pid: pid_t,
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fcntl(fildes: c_int, cmd: c_int, mut __valist: ...) -> c_int {
     // c_ulonglong
     let arg = match cmd {
···
     Sys::fcntl(fildes, cmd, arg).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn open(path: *const c_char, oflag: c_int, mut __valist: ...) -> c_int {
     let mode = if oflag & O_CREAT == O_CREAT
     /* || oflag & O_TMPFILE == O_TMPFILE */
···
     Sys::open(path, oflag, mode).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn cbindgen_stupid_struct_user_for_fcntl(a: flock) {}

src/header/float/mod.rs

···
 //! http://pubs.opengroup.org/onlinepubs/7908799/xsh/float.h.html
 
 use crate::{
-    header::_fenv::{fegetround, FE_TONEAREST},
+    header::_fenv::{FE_TONEAREST, fegetround},
     platform::types::*,
 };
 
 pub const FLT_RADIX: c_int = 2;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn flt_rounds() -> c_int {
     match fegetround() {
         FE_TONEAREST => 1,

src/header/fnmatch/mod.rs

···
 
 use crate::platform::types::*;
 use posix_regex::{
+    PosixRegex,
     compile::{Collation, Range, Token},
     tree::{Tree, TreeBuilder},
-    PosixRegex,
 };
 
 const ONCE: Range = Range(1, Some(1));
···
     builder.finish()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[linkage = "weak"] // often redefined in GNU programs
 pub unsafe extern "C" fn fnmatch(
     pattern: *const c_char,

src/header/getopt/mod.rs

···
     val: c_int,
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[linkage = "weak"] // often redefined in GNU programs
 pub unsafe extern "C" fn getopt_long(
     argc: c_int,

src/header/glob/mod.rs

···
 use crate::{
     c_str::{CStr, CString},
     header::{
-        dirent::{closedir, opendir, readdir, DIR},
+        dirent::{DIR, closedir, opendir, readdir},
         errno::*,
-        fnmatch::{fnmatch, FNM_NOESCAPE, FNM_PERIOD},
-        sys_stat::{stat, S_IFDIR, S_IFLNK, S_IFMT},
+        fnmatch::{FNM_NOESCAPE, FNM_PERIOD, fnmatch},
+        sys_stat::{S_IFDIR, S_IFLNK, S_IFMT, stat},
     },
     platform::{self, types::*},
 };
···
 }
 
 #[linkage = "weak"] // GNU prefers its own glob e.g. in Make
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn glob(
     pattern: *const c_char,
     flags: c_int,
···
 }
 
 #[linkage = "weak"] // GNU prefers its own glob e.g. in Make
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn globfree(pglob: *mut glob_t) {
     // Retake ownership
     if unsafe { !(*pglob).__opaque.is_null() } {
···
         let mut new_dir: Vec<u8> = Vec::new();
         new_dir.extend_from_slice(current_dir.to_bytes());
         new_dir.extend_from_slice(&pattern);
-        return inner_glob(
-            unsafe { &CStr::from_bytes_with_nul_unchecked(&new_dir) },
-            &new_glob_expr,
-            flags,
-            errfunc,
-        );
+        let new_dir_c = unsafe { CStr::from_bytes_with_nul_unchecked(&new_dir) };
+        return inner_glob(&new_dir_c, &new_glob_expr, flags, errfunc);
     }
 
     let mut fnmatch_flags = 0;

src/header/grp/mod.rs

···
     fs::File,
     header::{errno, fcntl, limits, string::strlen, unistd},
     io,
-    io::{prelude::*, BufReader, Lines},
+    io::{BufReader, Lines, prelude::*},
     platform,
     platform::types::*,
     sync::Mutex,
···
         unsafe {
             GROUP_BUF = Some(self.buffer);
             GROUP = self.reference;
-            &mut GROUP
+            &raw mut GROUP
         }
     }
 }
···
 }
 
 // MT-Unsafe race:grgid locale
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getgrgid(gid: gid_t) -> *mut group {
     let Ok(db) = File::open(GROUP_FILE.into(), fcntl::O_RDONLY) else {
         return ptr::null_mut();
···
 }
 
 // MT-Unsafe race:grnam locale
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getgrnam(name: *const c_char) -> *mut group {
     let Ok(db) = File::open(GROUP_FILE.into(), fcntl::O_RDONLY) else {
         return ptr::null_mut();
···
 }
 
 // MT-Safe locale
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getgrgid_r(
     gid: gid_t,
     result_buf: *mut group,
···
                         io::ErrorKind::NotFound => ENOENT,
                         _ => EIO,
                     },
-                }
+                };
             }
         };
 
···
 }
 
 // MT-Safe locale
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getgrnam_r(
     name: *const c_char,
     result_buf: *mut group,
···
 }
 
 // MT-Unsafe race:grent race:grentbuf locale
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getgrent() -> *mut group {
     let mut line_reader = unsafe { &mut *LINE_READER.get() };
 
···
 }
 
 // MT-Unsafe race:grent locale
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn endgrent() {
     unsafe {
         *(&mut *LINE_READER.get()) = None;
···
 }
 
 // MT-Unsafe race:grent locale
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setgrent() {
     let mut line_reader = unsafe { &mut *LINE_READER.get() };
     let Ok(db) = File::open(GROUP_FILE.into(), fcntl::O_RDONLY) else {
···
 
 // MT-Safe locale
 // Not POSIX
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getgrouplist(
     user: *const c_char,
     group: gid_t,
···
 
 // MT-Safe locale
 // Not POSIX
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn initgroups(user: *const c_char, gid: gid_t) -> c_int {
     let mut groups = [0; limits::NGROUPS_MAX];
     let mut count = groups.len() as c_int;

src/header/inttypes/mod.rs

···
 };
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/imaxabs.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn imaxabs(i: intmax_t) -> intmax_t {
     i.abs()
 }
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/imaxdiv.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn imaxdiv(i: intmax_t, j: intmax_t) -> imaxdiv_t {
     imaxdiv_t {
         quot: i / j,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strtoimax.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strtoimax(
     s: *const c_char,
     endptr: *mut *mut c_char,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strtoimax.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strtoumax(
     s: *const c_char,
     endptr: *mut *mut c_char,

src/header/langinfo/mod.rs

···
 /// # Safety
 /// - Caller must ensure `item` is a valid `nl_item` index.
 /// - Returns a pointer to a null-terminated string, or an empty string if the item is invalid.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn nl_langinfo(item: nl_item) -> *const c_char {
     // Validate the item and perform the lookup
     if (item as usize) < STRING_TABLE.len() {

src/header/libgen/mod.rs

···
 
 use crate::header::string::strlen;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn basename(str: *mut c_char) -> *mut c_char {
     if str.is_null() || unsafe { strlen(str) == 0 } {
         return ".\0".as_ptr() as *mut c_char;
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn dirname(str: *mut c_char) -> *mut c_char {
     if str.is_null() || unsafe { strlen(str) == 0 } {
         return ".\0".as_ptr() as *mut c_char;

src/header/locale/mod.rs

···
     thousands_sep: EMPTY_PTR,
 };
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn localeconv() -> *mut lconv {
-    &mut CURRENT_LOCALE as *mut _
+    &raw mut CURRENT_LOCALE as *mut _
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setlocale(_option: c_int, _val: *const c_char) -> *mut c_char {
     // TODO actually implement
-    C_LOCALE.as_mut_ptr() as *mut c_char
+    &raw mut C_LOCALE as *mut c_char
 }

src/header/malloc/mod.rs

···
 
 use crate::{
     header::errno::*,
-    platform::{self, types::*, Pal, Sys, ERRNO},
+    platform::{self, ERRNO, Pal, Sys, types::*},
 };
 use core::ptr;
 
 /// See <https://man7.org/linux/man-pages/man3/posix_memalign.3.html>.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pvalloc(size: size_t) -> *mut c_void {
     let page_size = Sys::getpagesize();
     // Find the smallest multiple of the page size in which the requested size

src/header/monetary/strfmon.rs

···
 use crate::platform::types::c_char;
 
-use super::{apply_grouping, FormatFlags, LocaleMonetaryInfo, DEFAULT_MONETARY};
+use super::{DEFAULT_MONETARY, FormatFlags, LocaleMonetaryInfo, apply_grouping};
 use alloc::string::{String, ToString};
 use core::{ffi::CStr, ptr, result, slice, str};
 use libm::{fabs, floor, pow, round, trunc};

src/header/net_if/mod.rs

···
 
 use crate::{
     c_str::CStr,
-    platform::{types::*, ERRNO},
+    platform::{ERRNO, types::*},
 };
 
 use super::errno::ENXIO;
···
 ///
 /// # Safety
 /// this is a no-op: the list returned by if_nameindex() is a ref to a constant
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn if_freenameindex(s: *mut if_nameindex) {}
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/if_indextoname.html>.
···
 /// Returns only static lifetime references to const names, does not reuse the buf pointer.
 /// Returns NULL in case of not found + ERRNO being set to ENXIO.
 /// Currently only checks against inteface index 1.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn if_indextoname(idx: c_uint, buf: *mut c_char) -> *const c_char {
     if idx == 1 {
         return IF_STUB_INTERFACE;
···
 /// # Safety
 /// Returns a constant pointer to a pre defined const stub list
 /// The end of the list is determined by an if_nameindex struct having if_index 0 and if_name NULL
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn if_nameindex() -> *const if_nameindex {
     &INTERFACES[0] as *const if_nameindex
 }
···
 /// # Safety
 /// Compares the name to a constant string and only returns an int as a result.
 /// An invalid name string will return an index of 0
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn if_nametoindex(name: *const c_char) -> c_uint {
     if name == null::<c_char>() {
         return 0;

src/header/netdb/host.rs

···
         unistd::SEEK_SET,
     },
     platform::{
+        Pal, Sys,
         rlb::{Line, RawLineBuffer},
         types::*,
-        Pal, Sys,
     },
+    raw_cell::RawCell,
 };
 
 use super::{bytes_to_box_str, hostent};
···
     h_length: 0,
     h_addr_list: ptr::null_mut(),
 };
-pub static mut HOST_NAME: Option<Vec<u8>> = None;
-pub static mut HOST_ALIASES: Option<Vec<Vec<u8>>> = None;
-static mut _HOST_ALIASES: Option<Vec<*mut c_char>> = None;
+pub static HOST_NAME: RawCell<Option<Vec<u8>>> = RawCell::new(None);
+pub static HOST_ALIASES: RawCell<Option<Vec<Vec<u8>>>> = RawCell::new(None);
+static _HOST_ALIASES: RawCell<Option<Vec<*mut c_char>>> = RawCell::new(None);
 pub static mut HOST_ADDR: Option<in_addr> = None;
 pub static mut HOST_ADDR_LIST: [*mut c_char; 2] = [ptr::null_mut(); 2];
 pub static mut _HOST_ADDR_LIST: [u8; 4] = [0u8; 4];
 static mut H_POS: usize = 0;
 pub static mut HOST_STAYOPEN: c_int = 0;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn endhostent() {
     if HOSTDB >= 0 {
         Sys::close(HOSTDB);
···
     HOSTDB = -1;
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sethostent(stayopen: c_int) {
     HOST_STAYOPEN = stayopen;
     if HOSTDB < 0 {
···
     H_POS = 0;
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn gethostent() -> *mut hostent {
     if HOSTDB < 0 {
         HOSTDB = Sys::open(c"/etc/hosts".into(), O_RDONLY, 0).or_minus_one_errno();
···
     let addr = addr.assume_init();
 
     _HOST_ADDR_LIST = addr.s_addr.to_ne_bytes();
-    HOST_ADDR_LIST = [_HOST_ADDR_LIST.as_mut_ptr() as *mut c_char, ptr::null_mut()];
+    HOST_ADDR_LIST = [&raw mut _HOST_ADDR_LIST as *mut c_char, ptr::null_mut()];
 
     HOST_ADDR = Some(addr);
 
···
     let mut _host_aliases: Vec<Vec<u8>> = iter
         .map(|alias| alias.bytes().chain(Some(b'\0')).collect())
         .collect();
-    HOST_ALIASES = Some(_host_aliases);
+    *HOST_ALIASES.as_mut_ptr() = Some(_host_aliases);
 
     let mut host_aliases: Vec<*mut c_char> = HOST_ALIASES
+        .unsafe_mut()
         .as_mut()
         .unwrap()
         .iter_mut()
···
         .chain([ptr::null_mut(), ptr::null_mut()])
         .collect();
 
-    HOST_NAME = Some(host_name);
+    *HOST_NAME.as_mut_ptr() = Some(host_name);
 
     HOST_ENTRY = hostent {
-        h_name: HOST_NAME.as_mut().unwrap().as_mut_ptr() as *mut c_char,
+        h_name: HOST_NAME.unsafe_mut().as_mut().unwrap().as_mut_ptr() as *mut c_char,
         h_aliases: host_aliases.as_mut_slice().as_mut_ptr(),
         h_addrtype: AF_INET,
         h_length: 4,
-        h_addr_list: HOST_ADDR_LIST.as_mut_ptr(),
+        h_addr_list: &raw mut HOST_ADDR_LIST as *mut _,
     };
-    _HOST_ALIASES = Some(host_aliases);
+    *_HOST_ALIASES.as_mut_ptr() = Some(host_aliases);
     if HOST_STAYOPEN == 0 {
         endhostent();
     }
-    &mut HOST_ENTRY as *mut hostent
+    &raw mut HOST_ENTRY as *mut hostent
 }

src/header/netdb/lookup.rs

···
 
 use crate::{
     out::Out,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 
 use crate::header::{
     errno::*,
-    netinet_in::{htons, in_addr, sockaddr_in, IPPROTO_UDP},
+    netinet_in::{IPPROTO_UDP, htons, in_addr, sockaddr_in},
     sys_socket::{
         self,
         constants::{AF_INET, SOCK_DGRAM},

src/header/netdb/mod.rs

···
         unistd::SEEK_SET,
     },
     platform::{
-        self,
+        self, Pal, Sys,
         rlb::{Line, RawLineBuffer},
         types::*,
-        Pal, Sys,
     },
+    raw_cell::RawCell,
 };
 
 #[cfg(target_os = "linux")]
···
     n_addrtype: 0,
     n_net: 0,
 };
-pub static mut NET_NAME: Option<Vec<u8>> = None;
-pub static mut NET_ALIASES: Option<Vec<Vec<u8>>> = None;
+pub static NET_NAME: RawCell<Option<Vec<u8>>> = RawCell::new(None);
+pub static NET_ALIASES: RawCell<Option<Vec<Vec<u8>>>> = RawCell::new(None);
 pub static mut NET_ADDR: Option<u32> = None;
 static mut N_POS: usize = 0;
 static mut NET_STAYOPEN: c_int = 0;
···
     p_aliases: ptr::null_mut(),
     p_proto: 0 as c_int,
 };
-static mut PROTO_NAME: Option<Vec<u8>> = None;
-static mut PROTO_ALIASES: Option<Vec<Vec<u8>>> = None;
+static PROTO_NAME: RawCell<Option<Vec<u8>>> = RawCell::new(None);
+static PROTO_ALIASES: RawCell<Option<Vec<Vec<u8>>>> = RawCell::new(None);
 static mut PROTO_NUM: Option<c_int> = None;
 static mut P_POS: usize = 0;
 static mut PROTO_STAYOPEN: c_int = 0;
···
     s_port: 0 as c_int,
     s_proto: ptr::null_mut(),
 };
-static mut SERV_NAME: Option<Vec<u8>> = None;
-static mut SERV_ALIASES: Option<Vec<Vec<u8>>> = None;
+static SERV_NAME: RawCell<Option<Vec<u8>>> = RawCell::new(None);
+static SERV_ALIASES: RawCell<Option<Vec<Vec<u8>>>> = RawCell::new(None);
 static mut SERV_PORT: Option<c_int> = None;
-static mut SERV_PROTO: Option<Vec<u8>> = None;
+static SERV_PROTO: RawCell<Option<Vec<u8>>> = RawCell::new(None);
 static mut S_POS: usize = 0;
 static mut SERV_STAYOPEN: c_int = 0;
 
···
     Box::from(core::str::from_utf8(bytes).unwrap_or(""))
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn endnetent() {
     Sys::close(NETDB);
     NETDB = 0;
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn endprotoent() {
     Sys::close(PROTODB);
     PROTODB = 0;
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn endservent() {
     Sys::close(SERVDB);
     SERVDB = 0;
···
 /// # Deprecation
 /// Deprecated as of POSIX.1-2001 and removed in POSIX.1-2008.
 /// New code should use [`getaddrinfo`] instead.
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[deprecated]
 pub unsafe extern "C" fn gethostbyaddr(
     v: *const c_void,
···
     _host_aliases.push(vec![b'\0']);
     let mut host_aliases: Vec<*mut c_char> = Vec::new();
     host_aliases.push(ptr::null_mut());
-    HOST_ALIASES = Some(_host_aliases);
+    *HOST_ALIASES.as_mut_ptr() = Some(_host_aliases);
 
     match lookup_addr(addr).map(|host_names| host_names.into_iter().next()) {
         Ok(Some(host_name)) => {
             _HOST_ADDR_LIST = addr.s_addr.to_ne_bytes();
-            HOST_ADDR_LIST = [_HOST_ADDR_LIST.as_mut_ptr() as *mut c_char, ptr::null_mut()];
-            HOST_NAME = Some(host_name);
+            HOST_ADDR_LIST = [&raw mut _HOST_ADDR_LIST as *mut c_char, ptr::null_mut()];
+            *HOST_NAME.as_mut_ptr() = Some(host_name);
             HOST_ENTRY = hostent {
-                h_name: HOST_NAME.as_mut().unwrap().as_mut_ptr() as *mut c_char,
+                h_name: HOST_NAME.unsafe_mut().as_mut().unwrap().as_mut_ptr() as *mut c_char,
                 h_aliases: host_aliases.as_mut_slice().as_mut_ptr(),
                 h_addrtype: format,
                 h_length: length as i32,
-                h_addr_list: HOST_ADDR_LIST.as_mut_ptr(),
+                h_addr_list: &raw mut HOST_ADDR_LIST as *mut _,
             };
-            &mut HOST_ENTRY
+            &raw mut HOST_ENTRY
         }
         // `glibc` sets errno if an address doesn't have a host name
         // `musl` uses the address as the host name in said case
···
 /// # Deprecation
 /// Deprecated as of POSIX.1-2001 and removed in POSIX.1-2008.
 /// New code should use [`getaddrinfo`] instead.
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[deprecated]
 pub unsafe extern "C" fn gethostbyname(name: *const c_char) -> *mut hostent {
     let name_cstr =
···
     };
 
     let host_name: Vec<u8> = name_cstr.to_bytes().to_vec();
-    HOST_NAME = Some(host_name);
+    *HOST_NAME.as_mut_ptr() = Some(host_name);
     _HOST_ADDR_LIST = host_addr.s_addr.to_ne_bytes();
-    HOST_ADDR_LIST = [_HOST_ADDR_LIST.as_mut_ptr() as *mut c_char, ptr::null_mut()];
+    HOST_ADDR_LIST = [&raw mut _HOST_ADDR_LIST as *mut c_char, ptr::null_mut()];
     HOST_ADDR = Some(host_addr);
 
     //TODO actually get aliases
···
     let mut host_aliases: Vec<*mut c_char> = Vec::new();
     host_aliases.push(ptr::null_mut());
     host_aliases.push(ptr::null_mut());
-    HOST_ALIASES = Some(_host_aliases);
+    *HOST_ALIASES.as_mut_ptr() = Some(_host_aliases);
 
     HOST_ENTRY = hostent {
-        h_name: HOST_NAME.as_mut().unwrap().as_mut_ptr() as *mut c_char,
+        h_name: HOST_NAME.unsafe_mut().as_mut().unwrap().as_mut_ptr() as *mut c_char,
         h_aliases: host_aliases.as_mut_slice().as_mut_ptr(),
         h_addrtype: AF_INET,
         h_length: 4,
-        h_addr_list: HOST_ADDR_LIST.as_mut_ptr(),
+        h_addr_list: &raw mut HOST_ADDR_LIST as *mut _,
     };
     sethostent(HOST_STAYOPEN);
-    &mut HOST_ENTRY as *mut hostent
+    &raw mut HOST_ENTRY as *mut hostent
 }
 
 pub unsafe extern "C" fn getnetbyaddr(net: u32, net_type: c_int) -> *mut netent {
     unimplemented!();
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getnetbyname(name: *const c_char) -> *mut netent {
     let mut n: *mut netent;
     setnetent(NET_STAYOPEN);
···
     ptr::null_mut() as *mut netent
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getnetent() -> *mut netent {
     // TODO: Rustify implementation
 
···
     let mut iter: SplitWhitespace = r.split_whitespace();
 
     let net_name = iter.next().unwrap().bytes().chain(Some(b'\0')).collect();
-    NET_NAME = Some(net_name);
+    *NET_NAME.as_mut_ptr() = Some(net_name);
 
     let addr_vec: Vec<u8> = iter.next().unwrap().bytes().chain(Some(b'\0')).collect();
     let addr_cstr = addr_vec.as_slice().as_ptr() as *const c_char;
···
         .map(|x| x.as_mut_ptr() as *mut c_char)
         .chain(Some(ptr::null_mut()))
         .collect();
-    NET_ALIASES = Some(_net_aliases);
+    *NET_ALIASES.as_mut_ptr() = Some(_net_aliases);
 
     NET_ENTRY = netent {
-        n_name: NET_NAME.as_mut().unwrap().as_mut_ptr() as *mut c_char,
+        n_name: NET_NAME.unsafe_mut().as_mut().unwrap().as_mut_ptr() as *mut c_char,
         n_aliases: net_aliases.as_mut_slice().as_mut_ptr(),
         n_addrtype: AF_INET,
         n_net: NET_ADDR.unwrap() as c_ulong,
     };
-    &mut NET_ENTRY as *mut netent
+    &raw mut NET_ENTRY as *mut netent
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getprotobyname(name: *const c_char) -> *mut protoent {
     let mut p: *mut protoent;
     setprotoent(PROTO_STAYOPEN);
···
     ptr::null_mut() as *mut protoent
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getprotobynumber(number: c_int) -> *mut protoent {
     setprotoent(PROTO_STAYOPEN);
     let mut p: *mut protoent;
···
     ptr::null_mut() as *mut protoent
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getprotoent() -> *mut protoent {
     if PROTODB == 0 {
         PROTODB = Sys::open(c"/etc/protocols".into(), O_RDONLY, 0).or_minus_one_errno();
···
         .chain(Some(ptr::null_mut()))
         .collect();
 
-    PROTO_ALIASES = Some(_proto_aliases);
-    PROTO_NAME = Some(proto_name);
+    *PROTO_ALIASES.as_mut_ptr() = Some(_proto_aliases);
+    *PROTO_NAME.as_mut_ptr() = Some(proto_name);
 
     PROTO_ENTRY = protoent {
-        p_name: PROTO_NAME.as_mut().unwrap().as_mut_slice().as_mut_ptr() as *mut c_char,
+        p_name: PROTO_NAME
+            .unsafe_mut()
+            .as_mut()
+            .unwrap()
+            .as_mut_slice()
+            .as_mut_ptr() as *mut c_char,
         p_aliases: proto_aliases.as_mut_slice().as_mut_ptr() as *mut *mut c_char,
         p_proto: PROTO_NUM.unwrap(),
     };
     if PROTO_STAYOPEN == 0 {
         endprotoent();
     }
-    &mut PROTO_ENTRY as *mut protoent
+    &raw mut PROTO_ENTRY as *mut protoent
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getservbyname(name: *const c_char, proto: *const c_char) -> *mut servent {
     setservent(SERV_STAYOPEN);
     let mut p: *mut servent;
···
     ptr::null_mut() as *mut servent
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getservbyport(port: c_int, proto: *const c_char) -> *mut servent {
     setservent(SERV_STAYOPEN);
     let mut p: *mut servent;
···
     ptr::null_mut()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getservent() -> *mut servent {
     if SERVDB == 0 {
         // TODO: Rustify
···
         serv_aliases.push(ptr::null_mut());
         serv_aliases.push(ptr::null_mut());
 
-        SERV_ALIASES = Some(_serv_aliases);
-        SERV_NAME = Some(serv_name);
-        SERV_PROTO = Some(proto);
+        *SERV_ALIASES.as_mut_ptr() = Some(_serv_aliases);
+        *SERV_NAME.as_mut_ptr() = Some(serv_name);
+        *SERV_PROTO.as_mut_ptr() = Some(proto);
 
         SERV_ENTRY = servent {
-            s_name: SERV_NAME.as_mut().unwrap().as_mut_slice().as_mut_ptr() as *mut c_char,
+            s_name: SERV_NAME
+                .unsafe_mut()
+                .as_mut()
+                .unwrap()
+                .as_mut_slice()
+                .as_mut_ptr() as *mut c_char,
             s_aliases: serv_aliases.as_mut_slice().as_mut_ptr() as *mut *mut c_char,
             s_port: SERV_PORT.unwrap(),
-            s_proto: SERV_PROTO.as_mut().unwrap().as_mut_slice().as_mut_ptr() as *mut c_char,
+            s_proto: SERV_PROTO
+                .unsafe_mut()
+                .as_mut()
+                .unwrap()
+                .as_mut_slice()
+                .as_mut_ptr() as *mut c_char,
         };
 
         if SERV_STAYOPEN == 0 {
             endservent();
         }
-        break &mut SERV_ENTRY as *mut servent;
+        break &raw mut SERV_ENTRY as *mut servent;
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setnetent(stayopen: c_int) {
     NET_STAYOPEN = stayopen;
     if NETDB == 0 {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setprotoent(stayopen: c_int) {
     PROTO_STAYOPEN = stayopen;
     if PROTODB == 0 {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setservent(stayopen: c_int) {
     SERV_STAYOPEN = stayopen;
     if SERVDB == 0 {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getaddrinfo(
     node: *const c_char,
     service: *const c_char,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getnameinfo(
     addr: *const sockaddr,
     addrlen: socklen_t,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn freeaddrinfo(res: *mut addrinfo) {
     let mut ai = res;
     while !ai.is_null() {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub const extern "C" fn gai_strerror(errcode: c_int) -> *const c_char {
     match errcode {
         EAI_BADFLAGS => c"Invalid flags",
···
 }
 
 /// Provide a pointer to relibc's internal [`H_ERRNO`].
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[deprecated]
 pub extern "C" fn __h_errno_location() -> *mut c_int {
     H_ERRNO.as_ptr()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[deprecated]
 pub const extern "C" fn hstrerror(errcode: c_int) -> *const c_char {
     match errcode {
···
 /// [`H_ERRNO`], [`hstrerror`], [`herror`], and other functions are deprecated as of
 /// POSIX.1-2001 and removed as of POSIX.1-2008. These functions are provided for backwards
 /// compatibility but should not be used by new code.
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[deprecated]
 pub extern "C" fn herror(prefix: *const c_char) {
     let code = H_ERRNO.get();

src/header/netinet_in/mod.rs

···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/netinet_in.h.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub static in6addr_any: in6_addr = in6_addr {
     s6_addr: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
 };
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/netinet_in.h.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub static in6addr_loopback: in6_addr = in6_addr {
     s6_addr: [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1],
 };
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/htonl.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn htonl(hostlong: uint32_t) -> uint32_t {
     hostlong.to_be()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/htonl.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn htons(hostshort: uint16_t) -> uint16_t {
     hostshort.to_be()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/htonl.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn ntohl(netlong: uint32_t) -> uint32_t {
     u32::from_be(netlong)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/htonl.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn ntohs(netshort: uint16_t) -> uint16_t {
     u16::from_be(netshort)
 }

src/header/poll/mod.rs

···
     error::ResultExt,
     fs::File,
     header::sys_epoll::{
-        epoll_create1, epoll_ctl, epoll_data, epoll_event, epoll_wait, EPOLLERR, EPOLLHUP, EPOLLIN,
-        EPOLLNVAL, EPOLLOUT, EPOLLPRI, EPOLLRDBAND, EPOLLRDNORM, EPOLLWRBAND, EPOLLWRNORM,
-        EPOLL_CLOEXEC, EPOLL_CTL_ADD,
+        EPOLL_CLOEXEC, EPOLL_CTL_ADD, EPOLLERR, EPOLLHUP, EPOLLIN, EPOLLNVAL, EPOLLOUT, EPOLLPRI,
+        EPOLLRDBAND, EPOLLRDNORM, EPOLLWRBAND, EPOLLWRNORM, epoll_create1, epoll_ctl, epoll_data,
+        epoll_event, epoll_wait,
     },
     platform::types::*,
 };
···
     count
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn poll(fds: *mut pollfd, nfds: nfds_t, timeout: c_int) -> c_int {
     trace_expr!(
         poll_epoll(

src/header/pthread/attr.rs

···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_destroy(attr: *mut pthread_attr_t) -> c_int {
     core::ptr::drop_in_place(attr);
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_getdetachstate(
     attr: *const pthread_attr_t,
     detachstate: *mut c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_getguardsize(
     attr: *const pthread_attr_t,
     size: *mut size_t,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_getinheritsched(
     attr: *const pthread_attr_t,
     inheritsched: *mut c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_getschedparam(
     attr: *const pthread_attr_t,
     param: *mut sched_param,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_getschedpolicy(
     attr: *const pthread_attr_t,
     policy: *mut c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_getscope(
     attr: *const pthread_attr_t,
     scope: *mut c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_getstack(
     attr: *const pthread_attr_t,
     stackaddr: *mut *mut c_void,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_getstacksize(
     attr: *const pthread_attr_t,
     stacksize: *mut size_t,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_init(attr: *mut pthread_attr_t) -> c_int {
     core::ptr::write(attr.cast::<RlctAttr>(), RlctAttr::default());
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_setdetachstate(
     attr: *mut pthread_attr_t,
     detachstate: c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_setguardsize(
     attr: *mut pthread_attr_t,
     guardsize: c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_setinheritsched(
     attr: *mut pthread_attr_t,
     inheritsched: c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_setschedparam(
     attr: *mut pthread_attr_t,
     param: *const sched_param,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_setschedpolicy(
     attr: *mut pthread_attr_t,
     policy: c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_setscope(attr: *mut pthread_attr_t, scope: c_int) -> c_int {
     (*attr.cast::<RlctAttr>()).scope = scope as u8;
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_setstack(
     attr: *mut pthread_attr_t,
     stackaddr: *mut c_void,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_attr_setstacksize(
     attr: *mut pthread_attr_t,
     stacksize: size_t,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_getattr_np(
     thread_ptr: pthread_t,
     attr_ptr: *mut pthread_attr_t,

src/header/pthread/barrier.rs

···
 }
 
 // Not async-signal-safe.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_barrier_destroy(barrier: *mut pthread_barrier_t) -> c_int {
     // Behavior is undefined if any thread is currently waiting when this is called.
 
···
 }
 
 // Not async-signal-safe.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_barrier_init(
     barrier: *mut pthread_barrier_t,
     attr: *const pthread_barrierattr_t,
···
 }
 
 // Not async-signal-safe.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_barrier_wait(barrier: *mut pthread_barrier_t) -> c_int {
     let barrier = &*barrier.cast::<RlctBarrier>();
 
···
 }
 
 // Not async-signal-safe.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_barrierattr_init(attr: *mut pthread_barrierattr_t) -> c_int {
     core::ptr::write(attr.cast::<RlctBarrierAttr>(), RlctBarrierAttr::default());
 
···
 }
 
 // Not async-signal-safe.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_barrierattr_setpshared(
     attr: *mut pthread_barrierattr_t,
     pshared: c_int,
···
 }
 
 // Not async-signal-safe.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_barrierattr_getpshared(
     attr: *const pthread_barrierattr_t,
     pshared: *mut c_int,
···
 }
 
 // Not async-signal-safe.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_barrierattr_destroy(attr: *mut pthread_barrierattr_t) -> c_int {
     core::ptr::drop_in_place(attr);
     0

src/header/pthread/cond.rs

···
 
 // PTHREAD_COND_INITIALIZER is defined manually in bits_pthread/cbindgen.toml
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_cond_broadcast(cond: *mut pthread_cond_t) -> c_int {
     e((&*cond.cast::<RlctCond>()).broadcast())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_cond_destroy(cond: *mut pthread_cond_t) -> c_int {
     // No-op
     core::ptr::drop_in_place(cond.cast::<RlctCond>());
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_cond_init(
     cond: *mut pthread_cond_t,
     _attr: *const pthread_condattr_t,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_cond_signal(cond: *mut pthread_cond_t) -> c_int {
     e((&*cond.cast::<RlctCond>()).signal())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_cond_timedwait(
     cond: *mut pthread_cond_t,
     mutex: *mut pthread_mutex_t,
···
     e((&*cond.cast::<RlctCond>()).timedwait(&*mutex.cast::<RlctMutex>(), &*timeout))
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_cond_wait(
     cond: *mut pthread_cond_t,
     mutex: *mut pthread_mutex_t,
···
     e((&*cond.cast::<RlctCond>()).wait(&*mutex.cast::<RlctMutex>()))
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_condattr_destroy(condattr: *mut pthread_condattr_t) -> c_int {
     core::ptr::drop_in_place(condattr.cast::<RlctCondAttr>());
     // No-op
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_condattr_getclock(
     condattr: *const pthread_condattr_t,
     clock: *mut clockid_t,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_condattr_getpshared(
     condattr: *const pthread_condattr_t,
     pshared: *mut c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_condattr_init(condattr: *mut pthread_condattr_t) -> c_int {
     condattr
         .cast::<RlctCondAttr>()
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_condattr_setclock(
     condattr: *mut pthread_condattr_t,
     clock: clockid_t,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_condattr_setpshared(
     condattr: *mut pthread_condattr_t,
     pshared: c_int,

src/header/pthread/mod.rs

···
 use crate::{
     error::Errno,
     header::{sched::*, time::timespec},
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
     pthread,
 };
 
···
 #[thread_local]
 pub static mut fork_hooks: [LinkedList<extern "C" fn()>; 3] = [const { LinkedList::new() }; 3];
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_cancel(thread: pthread_t) -> c_int {
     match pthread::cancel(&*thread.cast()) {
         Ok(()) => 0,
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_create(
     pthread: *mut pthread_t,
     attr: *const pthread_attr_t,
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_detach(pthread: pthread_t) -> c_int {
     match pthread::detach(&*pthread.cast()) {
         Ok(()) => 0,
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn pthread_equal(pthread1: pthread_t, pthread2: pthread_t) -> c_int {
     core::ptr::eq(pthread1, pthread2).into()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/pthread_atfork.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn pthread_atfork(
     prepare: Option<extern "C" fn()>,
     parent: Option<extern "C" fn()>,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_exit(retval: *mut c_void) -> ! {
     pthread::exit_current_thread(pthread::Retval(retval))
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_getconcurrency() -> c_int {
     // Redox and Linux threads are 1:1, not M:N.
     1
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_getcpuclockid(
     thread: pthread_t,
     clock_out: *mut clockid_t,
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_getschedparam(
     thread: pthread_t,
     policy_out: *mut c_int,
···
 pub mod tls;
 pub use tls::*;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_join(thread: pthread_t, retval: *mut *mut c_void) -> c_int {
     match pthread::join(&*thread.cast()) {
         Ok(pthread::Retval(ret)) => {
···
 pub mod rwlock;
 pub use self::rwlock::*;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_self() -> pthread_t {
     pthread::current_thread().unwrap_unchecked() as *const _ as *mut _
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_setcancelstate(state: c_int, oldstate: *mut c_int) -> c_int {
     match pthread::set_cancel_state(state) {
         Ok(old) => {
···
         Err(Errno(error)) => error,
     }
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_setcanceltype(ty: c_int, oldty: *mut c_int) -> c_int {
     match pthread::set_cancel_type(ty) {
         Ok(old) => {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn pthread_setconcurrency(concurrency: c_int) -> c_int {
     // Redox and Linux threads are 1:1, not M:N.
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_setschedparam(
     thread: pthread_t,
     policy: c_int,
···
 ) -> c_int {
     e(pthread::set_sched_param(&*thread.cast(), policy, &*param))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_setschedprio(thread: pthread_t, prio: c_int) -> c_int {
     e(pthread::set_sched_priority(&*thread.cast(), prio))
 }
···
 pub mod spin;
 pub use self::spin::*;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_testcancel() {
     pthread::testcancel();
 }
···
 
 // TODO: unwind? setjmp/longjmp?
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn __relibc_internal_pthread_cleanup_push(new_entry: *mut c_void) {
     let new_entry = &mut *new_entry.cast::<CleanupLinkedListEntry>();
 
     new_entry.prev = CLEANUP_LL_HEAD.get().cast();
     CLEANUP_LL_HEAD.set(new_entry);
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn __relibc_internal_pthread_cleanup_pop(execute: c_int) {
     let prev_head = CLEANUP_LL_HEAD.get().read();
     CLEANUP_LL_HEAD.set(prev_head.prev.cast());

src/header/pthread/mutex.rs

···
 
 // PTHREAD_MUTEX_INITIALIZER is defined in bits_pthread/cbindgen.toml
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutex_consistent(mutex: *mut pthread_mutex_t) -> c_int {
     e((&*mutex.cast::<RlctMutex>()).make_consistent())
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutex_destroy(mutex: *mut pthread_mutex_t) -> c_int {
     // No-op
     core::ptr::drop_in_place(mutex.cast::<RlctMutex>());
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutex_getprioceiling(
     mutex: *const pthread_mutex_t,
     prioceiling: *mut c_int,
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutex_init(
     mutex: *mut pthread_mutex_t,
     attr: *const pthread_mutexattr_t,
···
         Err(Errno(errno)) => errno,
     }
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutex_lock(mutex: *mut pthread_mutex_t) -> c_int {
     e((&*mutex.cast::<RlctMutex>()).lock())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutex_setprioceiling(
     mutex: *mut pthread_mutex_t,
     prioceiling: c_int,
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutex_timedlock(
     mutex: *mut pthread_mutex_t,
     timespec: *const timespec,
 ) -> c_int {
     e((&*mutex.cast::<RlctMutex>()).lock_with_timeout(&*timespec))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutex_trylock(mutex: *mut pthread_mutex_t) -> c_int {
     e((&*mutex.cast::<RlctMutex>()).try_lock())
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutex_unlock(mutex: *mut pthread_mutex_t) -> c_int {
     e((&*mutex.cast::<RlctMutex>()).unlock())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutexattr_destroy(attr: *mut pthread_mutexattr_t) -> c_int {
     // No-op
     core::ptr::drop_in_place(attr.cast::<RlctMutexAttr>());
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutexattr_getprioceiling(
     attr: *const pthread_mutexattr_t,
     prioceiling: *mut c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutexattr_getprotocol(
     attr: *const pthread_mutexattr_t,
     protocol: *mut c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutexattr_getpshared(
     attr: *const pthread_mutexattr_t,
     pshared: *mut c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutexattr_getrobust(
     attr: *const pthread_mutexattr_t,
     robust: *mut c_int,
···
     robust.write((*attr.cast::<RlctMutexAttr>()).robust);
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutexattr_gettype(
     attr: *const pthread_mutexattr_t,
     ty: *mut c_int,
···
     ty.write((*attr.cast::<RlctMutexAttr>()).ty);
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutexattr_init(attr: *mut pthread_mutexattr_t) -> c_int {
     attr.cast::<RlctMutexAttr>().write(RlctMutexAttr::default());
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutexattr_setprioceiling(
     attr: *mut pthread_mutexattr_t,
     prioceiling: c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutexattr_setprotocol(
     attr: *mut pthread_mutexattr_t,
     protocol: c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutexattr_setpshared(
     attr: *mut pthread_mutexattr_t,
     pshared: c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutexattr_setrobust(
     attr: *mut pthread_mutexattr_t,
     robust: c_int,
···
     (*attr.cast::<RlctMutexAttr>()).robust = robust;
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_mutexattr_settype(
     attr: *mut pthread_mutexattr_t,
     ty: c_int,

src/header/pthread/once.rs

···
 
 // PTHREAD_ONCE_INIT
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_once(
     once: *mut pthread_once_t,
     constructor: extern "C" fn(),

src/header/pthread/rwlock.rs

···
 
 use crate::pthread::Pshared;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlock_init(
     rwlock: *mut pthread_rwlock_t,
     attr: *const pthread_rwlockattr_t,
···
 
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlock_rdlock(rwlock: *mut pthread_rwlock_t) -> c_int {
     get(rwlock).acquire_read_lock(None);
 
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlock_timedrdlock(
     rwlock: *mut pthread_rwlock_t,
     timeout: *const timespec,
···
 
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlock_timedwrlock(
     rwlock: *mut pthread_rwlock_t,
     timeout: *const timespec,
···
 
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlock_tryrdlock(rwlock: *mut pthread_rwlock_t) -> c_int {
     match get(rwlock).try_acquire_read_lock() {
         Ok(()) => 0,
         Err(_) => EBUSY,
     }
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlock_trywrlock(rwlock: *mut pthread_rwlock_t) -> c_int {
     match get(rwlock).try_acquire_write_lock() {
         Ok(()) => 0,
         Err(_) => EBUSY,
     }
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlock_unlock(rwlock: *mut pthread_rwlock_t) -> c_int {
     get(rwlock).unlock();
 
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlock_wrlock(rwlock: *mut pthread_rwlock_t) -> c_int {
     get(rwlock).acquire_write_lock(None);
 
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlockattr_init(attr: *mut pthread_rwlockattr_t) -> c_int {
     attr.cast::<RlctRwlockAttr>()
         .write(RlctRwlockAttr::default());
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlockattr_getpshared(
     attr: *const pthread_rwlockattr_t,
     pshared_out: *mut c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlockattr_setpshared(
     attr: *mut pthread_rwlockattr_t,
     pshared: c_int,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlockattr_destroy(attr: *mut pthread_rwlockattr_t) -> c_int {
     core::ptr::drop_in_place(attr);
 
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_rwlock_destroy(rwlock: *mut pthread_rwlock_t) -> c_int {
     core::ptr::drop_in_place(rwlock);
 

src/header/pthread/spin.rs

···
 const UNLOCKED: c_int = 0;
 const LOCKED: c_int = 1;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_spin_destroy(spinlock: *mut pthread_spinlock_t) -> c_int {
     let _spinlock = &mut *spinlock.cast::<RlctSpinlock>();
 
     // No-op
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_spin_init(
     spinlock: *mut pthread_spinlock_t,
     _pshared: c_int,
···
 
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_spin_lock(spinlock: *mut pthread_spinlock_t) -> c_int {
     let spinlock = &*spinlock.cast::<RlctSpinlock>();
 
···
 
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_spin_trylock(spinlock: *mut pthread_spinlock_t) -> c_int {
     let spinlock = &*spinlock.cast::<RlctSpinlock>();
 
···
 
     0
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_spin_unlock(spinlock: *mut pthread_spinlock_t) -> c_int {
     let spinlock = &*spinlock.cast::<RlctSpinlock>();
 

src/header/pthread/tls.rs

···
 // TODO: What should this limit be?
 pub const PTHREAD_KEYS_MAX: u32 = 4096 * 32;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_getspecific(key: pthread_key_t) -> *mut c_void {
     //print!("pthread_getspecific key={:#0x}: ", key);
 
···
 
     data
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_key_create(
     key_ptr: *mut pthread_key_t,
     destructor: Option<extern "C" fn(value: *mut c_void)>,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_key_delete(key: pthread_key_t) -> c_int {
     if KEYS.lock().remove(&key).is_none() || VALUES.borrow_mut().remove(&key).is_none() {
         // We don't have to return anything, but it's not less expensive to ignore it.
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_setspecific(key: pthread_key_t, value: *const c_void) -> c_int {
     if !KEYS.lock().contains_key(&key) {
         // We don't have to return anything, but it's not less expensive to ignore it.
···
 
     let mut guard = VALUES.borrow_mut();
 
-    let Record { ref mut data, .. } = guard.entry(key).or_insert(Record {
+    let mut record = guard.entry(key).or_insert(Record {
         data: core::ptr::null_mut(),
     });
-    //println!("Valid key for pthread_setspecific key {:#0x} value {:p} (was {:p})", key, value, *data);
+    //println!("Valid key for pthread_setspecific key {:#0x} value {:p} (was {:p})", key, value, record.data);
 
-    *data = value as *mut c_void;
+    record.data = value as *mut c_void;
 
     0
 }

src/header/pty/mod.rs

···
 mod imp;
 
 /// See <https://www.man7.org/linux/man-pages/man3/openpty.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn openpty(
     amaster: *mut c_int,
     aslave: *mut c_int,
···
 }
 
 /// See <https://www.man7.org/linux/man-pages/man3/openpty.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn forkpty(
     pm: *mut c_int,
     name: *mut c_char,

src/header/pty/redox.rs

···
 use crate::{
+    Pal, Sys,
     error::ResultExt,
     header::{fcntl, unistd},
     platform::types::*,
-    Pal, Sys,
 };
 
 pub(super) unsafe fn openpty(name: &mut [u8]) -> Result<(c_int, c_int), ()> {

src/header/pwd/mod.rs

···
 use crate::{
     fs::File,
     header::{errno, fcntl, string::strcmp},
-    io::{prelude::*, BufReader, SeekFrom},
+    io::{BufReader, SeekFrom, prelude::*},
     platform::{self, types::*},
+    raw_cell::RawCell,
 };
 
 #[cfg(target_os = "linux")]
···
 }
 
 static mut PASSWD_BUF: Option<MaybeAllocated> = None;
-static mut PASSWD: passwd = passwd {
+static PASSWD: RawCell<passwd> = RawCell::new(passwd {
     pw_name: ptr::null_mut(),
     pw_passwd: ptr::null_mut(),
     pw_uid: 0,
···
     pw_gecos: ptr::null_mut(),
     pw_dir: ptr::null_mut(),
     pw_shell: ptr::null_mut(),
-};
+});
 
 #[derive(Clone, Copy, Debug)]
 struct DestBuffer {
···
     fn into_global(self) -> *mut passwd {
         unsafe {
             PASSWD_BUF = Some(self.buffer);
-            PASSWD = self.reference;
-            &mut PASSWD
+            *PASSWD.as_mut_ptr() = self.reference;
+            PASSWD.as_mut_ptr()
         }
     }
 }
···
     Other,
 }
 
-static mut READER: Option<BufReader<File>> = None;
+static READER: RawCell<Option<BufReader<File>>> = RawCell::new(None);
 
 fn parsed<I, O>(buf: Option<I>) -> Option<O>
 where
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/endpwent.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn endpwent() {
     unsafe {
-        READER = None;
+        *READER.as_mut_ptr() = None;
     }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/endpwent.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getpwent() -> *mut passwd {
-    let reader = match unsafe { &mut READER } {
+    let reader = match unsafe { &mut *READER.as_mut_ptr() } {
         Some(reader) => reader,
         None => {
             let file = match File::open(c"/etc/passwd".into(), fcntl::O_RDONLY) {
···
             };
             let reader = BufReader::new(file);
             unsafe {
-                READER = Some(reader);
-                READER.as_mut().unwrap()
+                *READER.as_mut_ptr() = Some(reader);
+                READER.unsafe_mut().as_mut().unwrap()
             }
         }
     };
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getpwnam.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getpwnam(name: *const c_char) -> *mut passwd {
     pwd_lookup(|parts| unsafe { strcmp(parts.pw_name, name) } == 0, None)
         .map(|res| res.into_global())
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getpwnam.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getpwnam_r(
     name: *const c_char,
     out: *mut passwd,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getpwuid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getpwuid(uid: uid_t) -> *mut passwd {
     pwd_lookup(|parts| parts.pw_uid == uid, None)
         .map(|res| res.into_global())
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getpwuid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getpwuid_r(
     uid: uid_t,
     out: *mut passwd,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/endpwent.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn setpwent() {
-    if let Some(reader) = unsafe { &mut READER } {
+    if let Some(reader) = unsafe { &mut *READER.as_mut_ptr() } {
         let _ = reader.seek(SeekFrom::Start(0));
     }
 }

src/header/regex/mod.rs

···
 use crate::{header::string::strlen, platform::types::*};
 use alloc::{borrow::Cow, boxed::Box};
 use core::{mem, ptr, slice};
-use posix_regex::{compile::Error as CompileError, tree::Tree, PosixRegex, PosixRegexBuilder};
+use posix_regex::{PosixRegex, PosixRegexBuilder, compile::Error as CompileError, tree::Tree};
 
 pub type regoff_t = size_t;
 
···
 pub const REG_ESPACE: c_int = 13;
 pub const REG_BADRPT: c_int = 14;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[linkage = "weak"] // redefined in GIT
 pub unsafe extern "C" fn regcomp(out: *mut regex_t, pat: *const c_char, cflags: c_int) -> c_int {
     let pat = slice::from_raw_parts(pat as *const u8, strlen(pat));
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[linkage = "weak"] // redefined in GIT
 pub unsafe extern "C" fn regfree(regex: *mut regex_t) {
     Box::from_raw((*regex).ptr);
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[linkage = "weak"] // redefined in GIT
 pub unsafe extern "C" fn regexec(
     regex: *const regex_t,
···
         }
     }
 
-    if matches.is_empty() {
-        REG_NOMATCH
-    } else {
-        0
-    }
+    if matches.is_empty() { REG_NOMATCH } else { 0 }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[linkage = "weak"] // redefined in GIT
 pub extern "C" fn regerror(
     code: c_int,

src/header/sched/mod.rs

···
 use crate::{
     error::ResultExt,
     header::time::timespec,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 
 #[derive(Clone, Copy, Debug)]
···
 pub const SCHED_RR: c_int = 1;
 pub const SCHED_OTHER: c_int = 2;
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn sched_get_priority_max(policy: c_int) -> c_int {
     todo!()
 }
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn sched_get_priority_min(policy: c_int) -> c_int {
     todo!()
 }
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn sched_getparam(pid: pid_t, param: *mut sched_param) -> c_int {
     todo!()
 }
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn sched_rr_get_interval(pid: pid_t, time: *const timespec) -> c_int {
     todo!()
 }
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn sched_setparam(pid: pid_t, param: *const sched_param) -> c_int {
     todo!()
 }
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn sched_setscheduler(
     pid: pid_t,
     policy: c_int,
···
 ) -> c_int {
     todo!()
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn sched_yield() -> c_int {
     Sys::sched_yield().map(|()| 0).or_minus_one_errno()
 }

src/header/semaphore/mod.rs

···
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/semaphore.h.html>.
 
 use crate::{
-    header::time::{timespec, CLOCK_MONOTONIC, CLOCK_REALTIME},
+    header::time::{CLOCK_MONOTONIC, CLOCK_REALTIME, timespec},
     platform::types::*,
 };
 
···
 pub type RlctSempahore = crate::sync::Semaphore;
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sem_close.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn sem_close(sem: *mut sem_t) -> c_int {
     todo!("named semaphores")
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sem_destroy.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sem_destroy(sem: *mut sem_t) -> c_int {
     core::ptr::drop_in_place(sem.cast::<RlctSempahore>());
     0
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sem_getvalue.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sem_getvalue(sem: *mut sem_t, sval: *mut c_int) -> c_int {
     sval.write(get(sem).value() as c_int);
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sem_init.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sem_init(sem: *mut sem_t, _pshared: c_int, value: c_uint) -> c_int {
     sem.cast::<RlctSempahore>().write(RlctSempahore::new(value));
 
···
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sem_open.html>.
 // TODO: va_list
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn sem_open(
     name: *const c_char,
     oflag: c_int, /* (va_list) value: c_uint */
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sem_post.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sem_post(sem: *mut sem_t) -> c_int {
     get(sem).post(1);
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sem_trywait.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sem_trywait(sem: *mut sem_t) -> c_int {
     get(sem).try_wait();
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sem_unlink.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn sem_unlink(name: *const c_char) -> c_int {
     todo!("named semaphores")
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sem_trywait.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sem_wait(sem: *mut sem_t) -> c_int {
     get(sem).wait(None, CLOCK_MONOTONIC);
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sem_clockwait.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sem_clockwait(
     sem: *mut sem_t,
     clock_id: clockid_t,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sem_timedwait.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sem_timedwait(sem: *mut sem_t, abstime: *const timespec) -> c_int {
     get(sem).wait(Some(&*abstime), CLOCK_REALTIME);
 

src/header/setjmp/mod.rs

···
 }
 
 //Each platform has different sizes for sigjmp_buf, currently only x86_64 is supported
-extern "C" {
+unsafe extern "C" {
     pub fn setjmp(jb: *mut u64) -> i32;
     pub fn longjmp(jb: *mut u64, ret: i32);
 }

src/header/sgtty/mod.rs

···
 
 use crate::{header::sys_ioctl::*, platform::types::*};
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn gtty(fd: c_int, out: *mut sgttyb) -> c_int {
     eprintln!("unimplemented: gtty({}, {:p})", fd, out);
     -1

src/header/shadow/mod.rs

···
     c_str::CStr,
     fs::File,
     header::{errno, fcntl, string::strlen},
-    io::{prelude::*, BufReader, Lines},
+    io::{BufReader, Lines, prelude::*},
     platform,
     platform::types::*,
 };
···
         unsafe {
             SHADOW_BUF = Some(self.buffer);
             SHADOW = self.reference;
-            &mut SHADOW
+            &raw mut SHADOW
         }
     }
 }
···
     Ok(OwnedSpwd { buffer, reference })
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getspnam(name: *const c_char) -> *mut spwd {
     let Ok(db) = File::open(SHADOW_FILE.into(), fcntl::O_RDONLY) else {
         return ptr::null_mut();
···
     ptr::null_mut()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getspnam_r(
     name: *const c_char,
     result_buf: *mut spwd,
···
     ENOENT
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setspent() {
     let mut line_reader = unsafe { &mut *LINE_READER.get() };
     if let Ok(db) = File::open(SHADOW_FILE.into(), fcntl::O_RDONLY) {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn endspent() {
     unsafe {
         *LINE_READER.get() = None;
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getspent() -> *mut spwd {
     let line_reader = unsafe { &mut *LINE_READER.get() };
     if line_reader.is_none() {

src/header/signal/mod.rs

···
     c_str::CStr,
     error::{Errno, ResultExt},
     header::{errno, setjmp, time::timespec},
-    platform::{self, types::*, Pal, PalSignal, Sys},
+    platform::{self, Pal, PalSignal, Sys, types::*},
 };
 
 pub use self::sys::*;
···
     pub si_value: sigval,
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn _cbindgen_export_siginfo(a: siginfo) {}
 
 #[derive(Clone, Copy)]
···
     options(att_syntax)
 );
 
-extern "C" {
+unsafe extern "C" {
     pub fn sigsetjmp(jb: *mut u64, savemask: i32) -> i32;
 }
 
 //NOTE for the following two functions, to see why they're implemented slightly differently from their intended behavior, read
 //     https://git.musl-libc.org/cgit/musl/commit/?id=583e55122e767b1586286a0d9c35e2a4027998ab
-#[no_mangle]
+#[unsafe(no_mangle)]
 unsafe extern "C" fn __sigsetjmp_tail(jb: *mut u64, ret: i32) -> i32 {
     let set = jb.wrapping_add(9);
     if ret > 0 {
···
     ret
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn siglongjmp(jb: *mut u64, ret: i32) {
     setjmp::longjmp(jb, ret);
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn kill(pid: pid_t, sig: c_int) -> c_int {
     Sys::kill(pid, sig).map(|()| 0).or_minus_one_errno()
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn sigqueue(pid: pid_t, sig: c_int, val: sigval) -> c_int {
     Sys::sigqueue(pid, sig, val)
         .map(|()| 0)
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn killpg(pgrp: pid_t, sig: c_int) -> c_int {
     Sys::killpg(pgrp, sig).map(|()| 0).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_kill(thread: pthread_t, sig: c_int) -> c_int {
     let os_tid = {
         let pthread = &*(thread as *const crate::pthread::Pthread);
···
     crate::header::pthread::e(Sys::rlct_kill(os_tid, sig as usize))
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pthread_sigmask(
     how: c_int,
     set: *const sigset_t,
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn raise(sig: c_int) -> c_int {
     Sys::raise(sig).map(|()| 0).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigaction(
     sig: c_int,
     act: *const sigaction,
···
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigaddset(set: *mut sigset_t, signo: c_int) -> c_int {
     if signo <= 0 || signo as usize > NSIG.max(SIGRTMAX)
     /* TODO */
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigaltstack(ss: *const stack_t, old_ss: *mut stack_t) -> c_int {
     Sys::sigaltstack(ss.as_ref(), old_ss.as_mut())
         .map(|()| 0)
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigdelset(set: *mut sigset_t, signo: c_int) -> c_int {
     if signo <= 0 || signo as usize > NSIG.max(SIGRTMAX)
     /* TODO */
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigemptyset(set: *mut sigset_t) -> c_int {
     if let Some(set) = (set as *mut SigSet).as_mut() {
         set.clear();
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigfillset(set: *mut sigset_t) -> c_int {
     if let Some(set) = (set as *mut SigSet).as_mut() {
         set.fill(.., true);
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sighold(sig: c_int) -> c_int {
     let mut pset = mem::MaybeUninit::<sigset_t>::uninit();
     unsafe { sigemptyset(pset.as_mut_ptr()) };
···
     sigprocmask(SIG_BLOCK, &set, ptr::null_mut())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn sigignore(sig: c_int) -> c_int {
     let mut psa = mem::MaybeUninit::<sigaction>::uninit();
     unsafe { sigemptyset(&mut (*psa.as_mut_ptr()).sa_mask) };
···
     unsafe { sigaction(sig, &mut sa, ptr::null_mut()) }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn siginterrupt(sig: c_int, flag: c_int) -> c_int {
     let mut psa = mem::MaybeUninit::<sigaction>::uninit();
     unsafe { sigaction(sig, ptr::null_mut(), psa.as_mut_ptr()) };
···
     unsafe { sigaction(sig, &mut sa, ptr::null_mut()) }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigismember(set: *const sigset_t, signo: c_int) -> c_int {
     if signo <= 0 || signo as usize > NSIG {
         platform::ERRNO.set(errno::EINVAL);
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn signal(
     sig: c_int,
     func: Option<extern "C" fn(c_int)>,
···
     unsafe { old_sa.assume_init() }.sa_handler
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigpause(sig: c_int) -> c_int {
     let mut pset = mem::MaybeUninit::<sigset_t>::uninit();
     sigprocmask(0, ptr::null_mut(), pset.as_mut_ptr());
···
     sigsuspend(&set)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigpending(set: *mut sigset_t) -> c_int {
     (|| Sys::sigpending(set.as_mut().ok_or(Errno(EFAULT))?))()
         .map(|()| 0)
···
 const STANDARD_SIG_MASK: sigset_t = (1 << 32) - 1;
 const RLCT_SIGNAL_MASK: sigset_t = BELOW_SIGRTMIN_MASK & !STANDARD_SIG_MASK;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigprocmask(
     how: c_int,
     set: *const sigset_t,
···
     .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigrelse(sig: c_int) -> c_int {
     let mut pset = mem::MaybeUninit::<sigset_t>::uninit();
     sigemptyset(pset.as_mut_ptr());
···
     sigprocmask(SIG_UNBLOCK, &mut set, ptr::null_mut())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigset(
     sig: c_int,
     func: Option<extern "C" fn(c_int)>,
···
     old_sa.assume_init().sa_handler
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigsuspend(sigmask: *const sigset_t) -> c_int {
     Err(Sys::sigsuspend(&*sigmask)).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigwait(set: *const sigset_t, sig: *mut c_int) -> c_int {
     let mut pinfo = mem::MaybeUninit::<siginfo_t>::uninit();
     if sigtimedwait(set, pinfo.as_mut_ptr(), ptr::null_mut()) < 0 {
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigtimedwait(
     set: *const sigset_t,
     // s/siginfo_t/siginfo due to https://github.com/mozilla/cbindgen/issues/621
···
         .map(|()| 0)
         .or_minus_one_errno()
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sigwaitinfo(set: *const sigset_t, sig: *mut siginfo_t) -> c_int {
     sigtimedwait(set, sig, core::ptr::null())
 }
···
     "Power failure\0",
     "Bad system call\0",
 ];
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn psignal(sig: c_int, prefix: *const c_char) {
     let c_description = usize::try_from(sig)
         .ok()
···
         string.as_bytes().len(),
     );
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn psiginfo(info: *const siginfo_t, prefix: *const c_char) {
     let siginfo_t {
         si_code,

src/header/signal/redox.rs

···
     _opaque: [u8; 520],
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn __completely_unused_cbindgen_workaround_fn_ucontext_mcontext(
     a: *const ucontext_t,
     b: *const mcontext_t,

src/header/stdio/default.rs

···
-use super::{constants, Buffer, BUFSIZ, FILE};
+use super::{BUFSIZ, Buffer, FILE, constants};
 use core::{cell::UnsafeCell, ptr};
 
 use crate::{
···
     DEFAULT_STDERR.call_once(|| GlobalFile::new(2, constants::F_NORD))
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub static mut stdin: *mut FILE = ptr::null_mut();
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub static mut stdout: *mut FILE = ptr::null_mut();
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub static mut stderr: *mut FILE = ptr::null_mut();

src/header/stdio/ext.rs

···
 use crate::{
-    header::stdio::{FILE, F_NORD, F_NOWR},
+    header::stdio::{F_NORD, F_NOWR, FILE},
     platform::types::*,
 };
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn __fpending(stream: *mut FILE) -> size_t {
     let stream = unsafe { &mut *stream }.lock();
 
     stream.writer.pending()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn __freadable(stream: *mut FILE) -> c_int {
     let stream = unsafe { &mut *stream }.lock();
 
     (stream.flags & F_NORD == 0) as c_int
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn __fwritable(stream: *mut FILE) -> c_int {
     let stream = unsafe { &mut *stream }.lock();
 
···
 }
 
 //TODO: Check last operation when read-write
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn __freading(stream: *mut FILE) -> c_int {
     let stream = unsafe { &mut *stream }.lock();
 
···
 }
 
 //TODO: Check last operation when read-write
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn __fwriting(stream: *mut FILE) -> c_int {
     let stream = unsafe { &mut *stream }.lock();
 

src/header/stdio/getdelim.rs

···
 };
 
 use crate::{
-    header::stdio::{default_stdout, feof, ferror, F_EOF, F_ERR},
+    header::stdio::{F_EOF, F_ERR, default_stdout, feof, ferror},
     platform::ERRNO,
 };
 
 /// see getdelim (getline is a special case of getdelim with delim == '\n')
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getline(
     lineptr: *mut *mut c_char,
     n: *mut size_t,
···
 /// "If an error occurs, the error indicator for the stream shall be set, and the function shall
 /// return -1 and set errno to indicate the error." but in cases that produce EINVAL even glibc
 /// doesn't seem to set the error indicator, so we also don't.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getdelim(
     lineptr: *mut *mut c_char,
     n: *mut size_t,

src/header/stdio/helpers.rs

···
 use alloc::boxed::Box;
 
-use super::{constants::*, Buffer, FILE};
+use super::{Buffer, FILE, constants::*};
 use crate::{
     c_str::CStr,
     error::Errno,

src/header/stdio/lookaheadreader.rs

···
-use super::{fseek_locked, ftell_locked, FILE, SEEK_SET};
+use super::{FILE, SEEK_SET, fseek_locked, ftell_locked};
 use crate::{io::Read, platform::types::off_t};
 struct LookAheadBuffer {
     buf: *const u8,

src/header/stdio/mod.rs

···
     },
     io::{self, BufRead, BufWriter, LineWriter, Read, Write},
     out::Out,
-    platform::{self, types::*, Pal, Sys, WriteByte, ERRNO},
+    platform::{self, ERRNO, Pal, Sys, WriteByte, types::*},
     sync::Mutex,
 };
 
···
 }
 
 /// Clears EOF and ERR indicators on a stream
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn clearerr(stream: *mut FILE) {
     let mut stream = (*stream).lock();
     stream.flags &= !(F_EOF | F_ERR);
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ctermid(s: *mut c_char) -> *mut c_char {
     static mut TERMID: [u8; L_ctermid] = *b"/dev/tty\0";
 
     if s.is_null() {
-        return TERMID.as_mut_ptr() as *mut c_char;
+        return &raw mut TERMID as *mut c_char;
     }
 
-    strncpy(s, TERMID.as_mut_ptr() as *mut c_char, L_ctermid)
+    strncpy(s, &raw mut TERMID as *mut c_char, L_ctermid)
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn cuserid(s: *mut c_char) -> *mut c_char {
     let mut buf: Vec<c_char> = vec![0; 256];
     let mut pwd: pwd::passwd = unsafe { mem::zeroed() };
···
 /// This function does not guarentee that the file buffer will be flushed or that the file
 /// descriptor will be closed, so if it is important that the file be written to, use `fflush()`
 /// prior to using this function.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fclose(stream: *mut FILE) -> c_int {
     let stream = &mut *stream;
     flockfile(stream);
···
 }
 
 /// Open a file from a file descriptor
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fdopen(fildes: c_int, mode: *const c_char) -> *mut FILE {
     helpers::_fdopen(fildes, CStr::from_ptr(mode))
         .map(|f| Box::into_raw(f))
···
 }
 
 /// Check for EOF
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn feof(stream: *mut FILE) -> c_int {
     let stream = (*stream).lock();
     stream.flags & F_EOF
 }
 
 /// Check for ERR
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ferror(stream: *mut FILE) -> c_int {
     let stream = (*stream).lock();
     stream.flags & F_ERR
···
 /// Flush output to stream, or sync read position
 /// Ensure the file is unlocked before calling this function, as it will attempt to lock the file
 /// itself.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fflush(stream: *mut FILE) -> c_int {
     if stream.is_null() {
         //TODO: flush all files!
···
 }
 
 /// Get a single char from a stream
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fgetc(stream: *mut FILE) -> c_int {
     let mut stream = (*stream).lock();
     if let Err(_) = (*stream).try_set_byte_orientation_unlocked() {
···
 }
 
 /// Get the position of the stream and store it in pos
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fgetpos(stream: *mut FILE, pos: *mut fpos_t) -> c_int {
     let off = ftello(stream);
     if off < 0 {
···
 }
 
 /// Get a string from the stream
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fgets(
     original: *mut c_char,
     max: c_int,
···
         // Write the NUL byte
         *out = 0;
     }
-    if wrote {
-        original
-    } else {
-        ptr::null_mut()
-    }
+    if wrote { original } else { ptr::null_mut() }
 }
 
 /// Get the underlying file descriptor
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fileno(stream: *mut FILE) -> c_int {
     let stream = (*stream).lock();
     *stream.file
···
 /// Lock the file
 /// Do not call any functions other than those with the `_unlocked` postfix while the file is
 /// locked
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn flockfile(file: *mut FILE) {
     (*file).lock.manual_lock();
 }
 
 /// Open the file in mode `mode`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fopen(filename: *const c_char, mode: *const c_char) -> *mut FILE {
     let initial_mode = *mode;
     if initial_mode != b'r' as c_char
···
 /// Clear the buffers of a stream
 /// Ensure the file is unlocked before calling this function, as it will attempt to lock the file
 /// itself.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn __fpurge(stream: *mut FILE) {
     if !stream.is_null() {
         let mut stream = (*stream).lock();
···
 }
 
 /// Insert a character into the stream
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fputc(c: c_int, stream: *mut FILE) -> c_int {
     let mut stream = (*stream).lock();
     if let Err(_) = (*stream).try_set_byte_orientation_unlocked() {
···
 }
 
 /// Insert a string into a stream
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fputs(s: *const c_char, stream: *mut FILE) -> c_int {
     let mut stream = (*stream).lock();
     if let Err(_) = (*stream).try_set_byte_orientation_unlocked() {
···
 }
 
 /// Read `nitems` of size `size` into `ptr` from `stream`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fread(
     ptr: *mut c_void,
     size: size_t,
···
     (read / size as usize) as size_t
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn freopen(
     filename: *const c_char,
     mode: *const c_char,
···
 }
 
 /// Seek to an offset `offset` from `whence`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fseek(stream: *mut FILE, offset: c_long, whence: c_int) -> c_int {
     fseeko(stream, offset as off_t, whence)
 }
 
 /// Seek to an offset `offset` from `whence`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fseeko(stream: *mut FILE, off: off_t, whence: c_int) -> c_int {
     let mut stream = (*stream).lock();
     fseek_locked(&mut *stream, off, whence)
···
 }
 
 /// Seek to a position `pos` in the file from the beginning of the file
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fsetpos(stream: *mut FILE, pos: *const fpos_t) -> c_int {
     fseeko(stream, *pos, SEEK_SET)
 }
 
 /// Get the current position of the cursor in the file
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ftell(stream: *mut FILE) -> c_long {
     ftello(stream) as c_long
 }
 
 /// Get the current position of the cursor in the file
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ftello(stream: *mut FILE) -> off_t {
     let mut stream = (*stream).lock();
     ftell_locked(&mut *stream)
···
 }
 
 /// Try to lock the file. Returns 0 for success, 1 for failure
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ftrylockfile(file: *mut FILE) -> c_int {
     if (*file).lock.manual_try_lock().is_ok() {
         0
···
 }
 
 /// Unlock the file
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn funlockfile(file: *mut FILE) {
     (*file).lock.manual_unlock();
 }
 
 /// Write `nitems` of size `size` from `ptr` to `stream`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fwrite(
     ptr: *const c_void,
     size: size_t,
···
 }
 
 /// Get a single char from a stream
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getc(stream: *mut FILE) -> c_int {
     let mut stream = (*stream).lock();
     getc_unlocked(&mut *stream)
 }
 
 /// Get a single char from `stdin`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getchar() -> c_int {
     fgetc(&mut *stdin)
 }
 
 /// Get a char from a stream without locking the stream
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getc_unlocked(stream: *mut FILE) -> c_int {
     if let Err(_) = (*stream).try_set_byte_orientation_unlocked() {
         return -1;
···
 }
 
 /// Get a char from `stdin` without locking `stdin`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getchar_unlocked() -> c_int {
     getc_unlocked(&mut *stdin)
 }
 
 /// Get a string from `stdin`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn gets(s: *mut c_char) -> *mut c_char {
     fgets(s, c_int::max_value(), &mut *stdin)
 }
 
 /// Get an integer from `stream`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getw(stream: *mut FILE) -> c_int {
     let mut ret: c_int = 0;
     if fread(
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pclose(stream: *mut FILE) -> c_int {
     // TODO: rusty error handling?
     let pid = {
···
     wstatus
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn perror(s: *const c_char) {
     let err = ERRNO.get();
     let err_str = if err >= 0 && err < STR_ERROR.len() as c_int {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn popen(command: *const c_char, mode: *const c_char) -> *mut FILE {
     //TODO: share code with system
 
···
 }
 
 /// Put a character `c` into `stream`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn putc(c: c_int, stream: *mut FILE) -> c_int {
     let mut stream = (*stream).lock();
     putc_unlocked(c, &mut *stream)
 }
 
 /// Put a character `c` into `stdout`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn putchar(c: c_int) -> c_int {
     fputc(c, &mut *stdout)
 }
 
 /// Put a character `c` into `stream` without locking `stream`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn putc_unlocked(c: c_int, stream: *mut FILE) -> c_int {
     if let Err(_) = (*stream).try_set_byte_orientation_unlocked() {
         return -1;
···
 }
 
 /// Put a character `c` into `stdout` without locking `stdout`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn putchar_unlocked(c: c_int) -> c_int {
     putc_unlocked(c, stdout)
 }
 
 /// Put a string `s` into `stdout`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn puts(s: *const c_char) -> c_int {
     let mut stream = (&mut *stdout).lock();
     if let Err(_) = (*stream).try_set_byte_orientation_unlocked() {
···
 }
 
 /// Put an integer `w` into `stream`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn putw(w: c_int, stream: *mut FILE) -> c_int {
     fwrite(&w as *const c_int as _, mem::size_of_val(&w), 1, stream) as i32 - 1
 }
 
 /// Delete file or directory `path`
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn remove(path: *const c_char) -> c_int {
     let path = CStr::from_ptr(path);
     Sys::unlink(path)
···
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn rename(oldpath: *const c_char, newpath: *const c_char) -> c_int {
     let oldpath = CStr::from_ptr(oldpath);
     let newpath = CStr::from_ptr(newpath);
···
 }
 
 /// Rewind `stream` back to the beginning of it
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn rewind(stream: *mut FILE) {
     fseeko(stream, 0, SEEK_SET);
 }
 
 /// Reset `stream` to use buffer `buf`. Buffer must be `BUFSIZ` in length
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setbuf(stream: *mut FILE, buf: *mut c_char) {
     setvbuf(
         stream,
···
 }
 
 /// Set buffering of `stream` to line buffered
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setlinebuf(stream: *mut FILE) {
     setvbuf(stream, ptr::null_mut(), _IOLBF, 0);
 }
 
 /// Reset `stream` to use buffer `buf` of size `size`
 /// If this isn't the meaning of unsafe, idk what is
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setvbuf(
     stream: *mut FILE,
     buf: *mut c_char,
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn tempnam(dir: *const c_char, pfx: *const c_char) -> *mut c_char {
     unsafe fn is_appropriate(pos_dir: *const c_char) -> bool {
         !pos_dir.is_null() && unistd::access(pos_dir, unistd::W_OK) == 0
···
     out_buf
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn tmpfile() -> *mut FILE {
     let mut file_name = *b"/tmp/tmpfileXXXXXX\0";
     let file_name = file_name.as_mut_ptr() as *mut c_char;
···
     fp
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn tmpnam(s: *mut c_char) -> *mut c_char {
     let buf = if s.is_null() {
-        TMPNAM_BUF.as_mut_ptr()
+        &raw mut TMPNAM_BUF as *mut _
     } else {
         s
     };
···
     stdlib::mktemp(buf);
     platform::ERRNO.set(err);
 
-    if *buf == 0 {
-        ptr::null_mut()
-    } else {
-        buf
-    }
+    if *buf == 0 { ptr::null_mut() } else { buf }
 }
 
 /// Push character `c` back onto `stream` so it'll be read next
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ungetc(c: c_int, stream: *mut FILE) -> c_int {
     let mut stream = (*stream).lock();
     if let Err(_) = (*stream).try_set_byte_orientation_unlocked() {
···
     c
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vfprintf(file: *mut FILE, format: *const c_char, ap: va_list) -> c_int {
     let mut file = (*file).lock();
     if let Err(_) = file.try_set_byte_orientation_unlocked() {
···
 
     printf::printf(&mut *file, format, ap)
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fprintf(
     file: *mut FILE,
     format: *const c_char,
···
     vfprintf(file, format, __valist.as_va_list())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vdprintf(fd: c_int, format: *const c_char, ap: va_list) -> c_int {
     let mut f = File::new(fd);
 
···
 
     printf::printf(f, format, ap)
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn dprintf(fd: c_int, format: *const c_char, mut __valist: ...) -> c_int {
     vdprintf(fd, format, __valist.as_va_list())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vprintf(format: *const c_char, ap: va_list) -> c_int {
     vfprintf(&mut *stdout, format, ap)
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn printf(format: *const c_char, mut __valist: ...) -> c_int {
     vfprintf(&mut *stdout, format, __valist.as_va_list())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vasprintf(
     strp: *mut *mut c_char,
     format: *const c_char,
···
     *strp = alloc_writer.leak() as *mut c_char;
     ret
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn asprintf(
     strp: *mut *mut c_char,
     format: *const c_char,
···
     vasprintf(strp, format, __valist.as_va_list())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vsnprintf(
     s: *mut c_char,
     n: size_t,
···
         ap,
     )
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn snprintf(
     s: *mut c_char,
     n: size_t,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vsprintf(s: *mut c_char, format: *const c_char, ap: va_list) -> c_int {
     printf::printf(&mut platform::UnsafeStringWriter(s as *mut u8), format, ap)
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sprintf(
     s: *mut c_char,
     format: *const c_char,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vfscanf(file: *mut FILE, format: *const c_char, ap: va_list) -> c_int {
     let ret = {
         let mut file = (*file).lock();
···
     };
     ret
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fscanf(
     file: *mut FILE,
     format: *const c_char,
···
     vfscanf(file, format, __valist.as_va_list())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vscanf(format: *const c_char, ap: va_list) -> c_int {
     vfscanf(&mut *stdin, format, ap)
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn scanf(format: *const c_char, mut __valist: ...) -> c_int {
     vfscanf(&mut *stdin, format, __valist.as_va_list())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vsscanf(s: *const c_char, format: *const c_char, ap: va_list) -> c_int {
     let reader = (s as *const u8).into();
     scanf::scanf(reader, format, ap)
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sscanf(
     s: *const c_char,
     format: *const c_char,

src/header/stdio/printf.rs

···
 
             (FmtKind::Char, _)
             | (FmtKind::Unsigned, IntKind::Byte)
-            | (FmtKind::Signed, IntKind::Byte) => VaArg::c_char(ap.arg::<c_char>()),
+            | (FmtKind::Signed, IntKind::Byte) => {
+                // c_int is passed but truncated to c_char
+                VaArg::c_char(ap.arg::<c_int>() as c_char)
+            }
             (FmtKind::Unsigned, IntKind::Short) | (FmtKind::Signed, IntKind::Short) => {
-                VaArg::c_short(ap.arg::<c_short>())
+                // c_int is passed but truncated to c_short
+                VaArg::c_short(ap.arg::<c_int>() as c_short)
             }
             (FmtKind::Unsigned, IntKind::Int) | (FmtKind::Signed, IntKind::Int) => {
                 VaArg::c_int(ap.arg::<c_int>())

src/header/stdio/scanf.rs

···
 unsafe fn next_byte(string: &mut *const c_char) -> Result<u8, c_int> {
     let c = **string as u8;
     *string = string.offset(1);
-    if c == 0 {
-        Err(-1)
-    } else {
-        Ok(c)
-    }
+    if c == 0 { Err(-1) } else { Ok(c) }
 }
 
 unsafe fn inner_scanf(

src/header/stdlib/mod.rs

···
 
 use core::{convert::TryFrom, intrinsics, iter, mem, ptr, slice};
 use rand::{
-    distributions::{Alphanumeric, Distribution, Uniform},
     Rng, SeedableRng,
+    distributions::{Alphanumeric, Distribution, Uniform},
 };
 use rand_jitter::JitterRng;
 use rand_xorshift::XorShiftRng;
···
         string::*,
         sys_ioctl::*,
         time::constants::CLOCK_MONOTONIC,
-        unistd::{self, sysconf, _SC_PAGESIZE},
+        unistd::{self, _SC_PAGESIZE, sysconf},
         wchar::*,
     },
     ld_so,
     out::Out,
-    platform::{self, types::*, Pal, Sys},
+    platform::{self, Pal, Sys, types::*},
+    raw_cell::RawCell,
     sync::Once,
 };
 
···
 //Maximum number of bytes in a multibyte characters for any locale
 pub const MB_LEN_MAX: c_int = 4;
 
-static mut ATEXIT_FUNCS: [Option<extern "C" fn()>; 32] = [None; 32];
-static mut AT_QUICK_EXIT_FUNCS: [Option<extern "C" fn()>; 32] = [None; 32];
-static mut L64A_BUFFER: [c_char; 7] = [0; 7]; // up to 6 digits plus null terminator
+static ATEXIT_FUNCS: RawCell<[Option<extern "C" fn()>; 32]> = RawCell::new([None; 32]);
+static AT_QUICK_EXIT_FUNCS: RawCell<[Option<extern "C" fn()>; 32]> = RawCell::new([None; 32]);
+static L64A_BUFFER: RawCell<[c_char; 7]> = RawCell::new([0; 7]); // up to 6 digits plus null terminator
 static mut RNG: Option<XorShiftRng> = None;
 
 // TODO: This could be const fn, but the trait system won't allow that.
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/_Exit.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn _Exit(status: c_int) -> ! {
     unistd::_exit(status);
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/a64l.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn a64l(s: *const c_char) -> c_long {
     // Early return upon null pointer argument
     if s.is_null() {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/abort.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn abort() -> ! {
     eprintln!("Abort");
     intrinsics::abort();
 }
 
 #[cfg(not(target_pointer_width = "64"))]
-#[no_mangle]
+#[unsafe(no_mangle)]
 static __stack_chk_guard: uintptr_t = 0x19fcadfe;
 
 #[cfg(target_pointer_width = "64")]
-#[no_mangle]
+#[unsafe(no_mangle)]
 static __stack_chk_guard: uintptr_t = 0xd048c37519fcadfe;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 unsafe extern "C" fn __stack_chk_fail() -> ! {
     abort();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/abs.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn abs(i: c_int) -> c_int {
     i.abs()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/aligned_alloc.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn aligned_alloc(alignment: size_t, size: size_t) -> *mut c_void {
     if size % alignment == 0 {
         /* The size-is-multiple-of-alignment requirement is the only
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/at_quick_exit.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn at_quick_exit(func: Option<extern "C" fn()>) -> c_int {
-    for i in 0..AT_QUICK_EXIT_FUNCS.len() {
-        if AT_QUICK_EXIT_FUNCS[i] == None {
-            AT_QUICK_EXIT_FUNCS[i] = func;
+    for i in 0..AT_QUICK_EXIT_FUNCS.unsafe_ref().len() {
+        if AT_QUICK_EXIT_FUNCS.unsafe_ref()[i] == None {
+            AT_QUICK_EXIT_FUNCS.unsafe_mut()[i] = func;
             return 0;
         }
     }
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/atexit.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn atexit(func: Option<extern "C" fn()>) -> c_int {
-    for i in 0..ATEXIT_FUNCS.len() {
-        if ATEXIT_FUNCS[i] == None {
-            ATEXIT_FUNCS[i] = func;
+    for i in 0..ATEXIT_FUNCS.unsafe_ref().len() {
+        if ATEXIT_FUNCS.unsafe_ref()[i] == None {
+            ATEXIT_FUNCS.unsafe_mut()[i] = func;
             return 0;
         }
     }
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/atof.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn atof(s: *const c_char) -> c_double {
     strtod(s, ptr::null_mut())
 }
···
             s = s.offset(1);
         }
 
-        if neg_sign {
-            n
-        } else {
-            -n
-        }
+        if neg_sign { n } else { -n }
     }};
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/atoi.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn atoi(s: *const c_char) -> c_int {
     dec_num_from_ascii!(s, c_int)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/atol.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn atol(s: *const c_char) -> c_long {
     dec_num_from_ascii!(s, c_long)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/atol.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn atoll(s: *const c_char) -> c_longlong {
     dec_num_from_ascii!(s, c_longlong)
 }
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/bsearch.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn bsearch(
     key: *const c_void,
     base: *const c_void,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/calloc.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn calloc(nelem: size_t, elsize: size_t) -> *mut c_void {
     //Handle possible integer overflow in size calculation
     match nelem.checked_mul(elsize) {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/div.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn div(numer: c_int, denom: c_int) -> div_t {
     div_t {
         quot: numer / denom,
···
 /// # Panics
 /// Panics if the function is unable to obtain a lock on the generator's global
 /// state.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn drand48() -> c_double {
     let params = rand48::params();
     let mut xsubi = rand48::xsubi_lock();
···
 /// The `ecvt()` function was marked as legacy in the Open Group Base
 /// Specifications Issue 6, and the function was removed in Issue 7.
 #[deprecated]
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn ecvt(
     value: c_double,
     ndigit: c_int,
···
 /// # Panics
 /// Panics if the function is unable to obtain a lock on the generator's global
 /// state.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn erand48(xsubi: *mut c_ushort) -> c_double {
     let params = rand48::params();
     let xsubi_mut: &mut [c_ushort; 3] = slice::from_raw_parts_mut(xsubi, 3).try_into().unwrap();
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/exit.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn exit(status: c_int) -> ! {
-    extern "C" {
+    unsafe extern "C" {
         static __fini_array_start: extern "C" fn();
         static __fini_array_end: extern "C" fn();
 
         fn _fini();
     }
 
-    for i in (0..ATEXIT_FUNCS.len()).rev() {
-        if let Some(func) = ATEXIT_FUNCS[i] {
+    for i in (0..ATEXIT_FUNCS.unsafe_ref().len()).rev() {
+        if let Some(func) = ATEXIT_FUNCS.unsafe_ref()[i] {
             (func)();
         }
     }
···
 /// The `fcvt()` function was marked as legacy in the Open Group Base
 /// Specifications Issue 6, and the function was removed in Issue 7.
 #[deprecated]
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn fcvt(
     value: c_double,
     ndigit: c_int,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/free.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn free(ptr: *mut c_void) {
     platform::free(ptr);
 }
···
 /// The `gcvt()` function was marked as legacy in the Open Group Base
 /// Specifications Issue 6, and the function was removed in Issue 7.
 #[deprecated]
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn gcvt(value: c_double, ndigit: c_int, buf: *mut c_char) -> *mut c_char {
     unimplemented!();
 }
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getenv.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getenv(name: *const c_char) -> *mut c_char {
     find_env(name).map(|val| val.1).unwrap_or(ptr::null_mut())
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getsubopt.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getsubopt(
     optionp: *mut *mut c_char,
     tokens: *const *mut c_char,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/grantpt.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn grantpt(fildes: c_int) -> c_int {
     // No-op on Linux and Redox
     0
···
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/initstate.html>.
 // Ported from musl
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn initstate(seed: c_uint, state: *mut c_char, size: size_t) -> *mut c_char {
     if size < 8 {
         ptr::null_mut()
···
 /// # Panics
 /// Panics if the function is unable to obtain a lock on the generator's global
 /// state.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn jrand48(xsubi: *mut c_ushort) -> c_long {
     let params = rand48::params();
     let xsubi_mut: &mut [c_ushort; 3] = slice::from_raw_parts_mut(xsubi, 3).try_into().unwrap();
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/a64l.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn l64a(value: c_long) -> *mut c_char {
     // POSIX says we should only consider the lower 32 bits of value.
     let value_as_i32 = value as i32;
···
     let num_output_digits = usize::try_from(6 - (value_as_i32.leading_zeros() + 4) / 6).unwrap();
 
     // Reset buffer (and have null terminator in place for any result)
-    L64A_BUFFER = [0; 7];
+    *L64A_BUFFER.as_mut_ptr() = [0; 7];
 
     for i in 0..num_output_digits {
         // Conversion to c_char always succeeds for the range 0..=63
         let digit_value = c_char::try_from((value_as_i32 >> 6 * i) & 63).unwrap();
 
-        L64A_BUFFER[i] = match digit_value {
+        L64A_BUFFER.unsafe_mut()[i] = match digit_value {
             0..=11 => {
                 // ./0123456789 for values 0 to 11. b'.' == 46
                 46 + digit_value
···
         };
     }
 
-    L64A_BUFFER.as_mut_ptr()
+    L64A_BUFFER.unsafe_mut().as_mut_ptr()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/labs.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn labs(i: c_long) -> c_long {
     i.abs()
 }
···
 /// # Panics
 /// Panics if the function is unable to obtain a lock on the generator's global
 /// state.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn lcong48(param: *mut c_ushort) {
     let mut xsubi = rand48::xsubi_lock();
     let mut params = rand48::params_mut();
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/ldiv.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn ldiv(numer: c_long, denom: c_long) -> ldiv_t {
     ldiv_t {
         quot: numer / denom,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/labs.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn llabs(i: c_longlong) -> c_longlong {
     i.abs()
 }
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/ldiv.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn lldiv(numer: c_longlong, denom: c_longlong) -> lldiv_t {
     lldiv_t {
         quot: numer / denom,
···
 /// # Panics
 /// Panics if the function is unable to obtain a lock on the generator's global
 /// state.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn lrand48() -> c_long {
     let params = rand48::params();
     let mut xsubi = rand48::xsubi_lock();
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/malloc.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn malloc(size: size_t) -> *mut c_void {
     let ptr = platform::alloc(size);
     if ptr.is_null() {
···
 
 /// Non-POSIX, see <https://www.man7.org/linux/man-pages/man3/posix_memalign.3.html>.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn memalign(alignment: size_t, size: size_t) -> *mut c_void {
     if alignment.is_power_of_two() {
         let ptr = platform::alloc_align(size, alignment);
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mblen.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mblen(s: *const c_char, n: size_t) -> c_int {
     let mut wc: wchar_t = 0;
     let mut state: mbstate_t = mbstate_t {};
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mbstowcs.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mbstowcs(pwcs: *mut wchar_t, mut s: *const c_char, n: size_t) -> size_t {
     let mut state: mbstate_t = mbstate_t {};
     mbsrtowcs(pwcs, &mut s, n, &mut state)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mbtowc.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mbtowc(pwc: *mut wchar_t, s: *const c_char, n: size_t) -> c_int {
     let mut state: mbstate_t = mbstate_t {};
     mbrtowc(pwc, s, n, &mut state) as c_int
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mkdtemp.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mkdtemp(name: *mut c_char) -> *mut c_char {
     inner_mktemp(name, 0, || {
         let name_c = CStr::from_ptr(name);
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mkdtemp.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mkostemp(name: *mut c_char, flags: c_int) -> c_int {
     mkostemps(name, 0, flags)
 }
 
 /// Non-POSIX, see <https://www.man7.org/linux/man-pages/man3/mkstemp.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mkostemps(
     name: *mut c_char,
     suffix_len: c_int,
···
         let name = CStr::from_ptr(name);
         let fd = Sys::open(name, flags, 0o600).or_minus_one_errno();
 
-        if fd >= 0 {
-            Some(fd)
-        } else {
-            None
-        }
+        if fd >= 0 { Some(fd) } else { None }
     })
     .unwrap_or(-1)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mkdtemp.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mkstemp(name: *mut c_char) -> c_int {
     mkostemps(name, 0, 0)
 }
 
 /// Non-POSIX, see <https://www.man7.org/linux/man-pages/man3/mkstemp.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mkstemps(name: *mut c_char, suffix_len: c_int) -> c_int {
     mkostemps(name, suffix_len, 0)
 }
···
 /// The `mktemp()` function was marked as legacy in the Open Group Base
 /// Specifications Issue 6, and the function was removed in Issue 7.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mktemp(name: *mut c_char) -> *mut c_char {
     if inner_mktemp(name, 0, || {
         let name = CStr::from_ptr(name);
···
 /// # Panics
 /// Panics if the function is unable to obtain a lock on the generator's global
 /// state.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn mrand48() -> c_long {
     let params = rand48::params();
     let mut xsubi = rand48::xsubi_lock();
···
 /// # Panics
 /// Panics if the function is unable to obtain a lock on the generator's global
 /// state.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn nrand48(xsubi: *mut c_ushort) -> c_long {
     let params = rand48::params();
     let xsubi_mut: &mut [c_ushort; 3] = slice::from_raw_parts_mut(xsubi, 3).try_into().unwrap();
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/posix_memalign.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn posix_memalign(
     memptr: *mut *mut c_void,
     alignment: size_t,
···
     if alignment % VOID_PTR_SIZE == 0 && alignment.is_power_of_two() {
         let ptr = platform::alloc_align(size, alignment);
         *memptr = ptr;
-        if ptr.is_null() {
-            ENOMEM
-        } else {
-            0
-        }
+        if ptr.is_null() { ENOMEM } else { 0 }
     } else {
         *memptr = ptr::null_mut();
         EINVAL
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/posix_openpt.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn posix_openpt(flags: c_int) -> c_int {
     #[cfg(target_os = "redox")]
     let r = open((b"/scheme/pty\0" as *const u8).cast(), O_CREAT);
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/ptsname.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ptsname(fd: c_int) -> *mut c_char {
-    static mut PTS_BUFFER: [c_char; 9 + mem::size_of::<c_int>() * 3 + 1] =
-        [0; 9 + mem::size_of::<c_int>() * 3 + 1];
-    if ptsname_r(fd, PTS_BUFFER.as_mut_ptr(), PTS_BUFFER.len()) != 0 {
+    const PTS_BUFFER_LEN: usize = 9 + mem::size_of::<c_int>() * 3 + 1;
+    static mut PTS_BUFFER: [c_char; PTS_BUFFER_LEN] = [0; PTS_BUFFER_LEN];
+    if ptsname_r(fd, &raw mut PTS_BUFFER as *mut _, PTS_BUFFER_LEN) != 0 {
         ptr::null_mut()
     } else {
-        PTS_BUFFER.as_mut_ptr()
+        &raw mut PTS_BUFFER as *mut _
     }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/ptsname.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ptsname_r(fd: c_int, buf: *mut c_char, buflen: size_t) -> c_int {
     if buf.is_null() {
         platform::ERRNO.set(EINVAL);
···
 unsafe fn put_new_env(insert: *mut c_char) {
     // XXX: Another problem is that `environ` can be set to any pointer, which means there is a
     // chance of a memory leak. But we can check if it was the same as before, like musl does.
-    if platform::environ == platform::OUR_ENVIRON.as_mut_ptr() {
-        *platform::OUR_ENVIRON.last_mut().unwrap() = insert;
-        platform::OUR_ENVIRON.push(core::ptr::null_mut());
+    if platform::environ == platform::OUR_ENVIRON.unsafe_mut().as_mut_ptr() {
+        {
+            let mut our_environ = &mut *platform::OUR_ENVIRON.as_mut_ptr();
+            *our_environ.last_mut().unwrap() = insert;
+            our_environ.push(core::ptr::null_mut());
+        }
         // Likely a no-op but is needed due to Stacked Borrows.
-        platform::environ = platform::OUR_ENVIRON.as_mut_ptr();
+        platform::environ = platform::OUR_ENVIRON.unsafe_mut().as_mut_ptr();
     } else {
-        platform::OUR_ENVIRON.clear();
-        platform::OUR_ENVIRON.extend(platform::environ_iter());
-        platform::OUR_ENVIRON.push(insert);
-        platform::OUR_ENVIRON.push(core::ptr::null_mut());
-        platform::environ = platform::OUR_ENVIRON.as_mut_ptr();
+        {
+            let mut our_environ = &mut *platform::OUR_ENVIRON.as_mut_ptr();
+            our_environ.clear();
+            our_environ.extend(platform::environ_iter());
+            our_environ.push(insert);
+            our_environ.push(core::ptr::null_mut());
+        }
+        platform::environ = platform::OUR_ENVIRON.unsafe_mut().as_mut_ptr();
     }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/putenv.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn putenv(insert: *mut c_char) -> c_int {
     assert_ne!(insert, ptr::null_mut(), "putenv(NULL)");
     if let Some((i, _)) = find_env(insert) {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/qsort.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn qsort(
     base: *mut c_void,
     nel: size_t,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/qsort.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn qsort_r(
     base: *mut c_void,
     nel: size_t,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/quick_exit.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn quick_exit(status: c_int) -> ! {
-    for i in (0..AT_QUICK_EXIT_FUNCS.len()).rev() {
-        if let Some(func) = AT_QUICK_EXIT_FUNCS[i] {
+    for i in (0..AT_QUICK_EXIT_FUNCS.unsafe_ref().len()).rev() {
+        if let Some(func) = AT_QUICK_EXIT_FUNCS.unsafe_ref()[i] {
             (func)();
         }
     }
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/rand.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn rand() -> c_int {
     match RNG {
         Some(ref mut rng) => rng_sampler().sample(rng),
···
 /// # Deprecation
 /// The `rand_r()` function was marked as obsolescent in the Open Group Base
 /// Specifications Issue 7, and the function was removed in Issue 8.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn rand_r(seed: *mut c_uint) -> c_int {
     if seed.is_null() {
         errno::EINVAL
···
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/initstate.html>.
 // Ported from musl
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn random() -> c_long {
     let mut random_state = random::state_lock();
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/realloc.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn realloc(ptr: *mut c_void, size: size_t) -> *mut c_void {
     let new_ptr = platform::realloc(ptr, size);
     if new_ptr.is_null() {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/realloc.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn reallocarray(ptr: *mut c_void, m: size_t, n: size_t) -> *mut c_void {
     //Handle possible integer overflow in size calculation
     match m.checked_mul(n) {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/realpath.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn realpath(pathname: *const c_char, resolved: *mut c_char) -> *mut c_char {
     let ptr = if resolved.is_null() {
         malloc(limits::PATH_MAX) as *mut c_char
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getenv.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn secure_getenv(name: *const c_char) -> *mut c_char {
     unimplemented!();
 }
···
 /// # Panics
 /// Panics if the function is unable to obtain a lock on the generator's global
 /// state.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn seed48(seed16v: *mut c_ushort) -> *mut c_ushort {
     static mut BUFFER: [c_ushort; 3] = [0; 3];
 
···
     BUFFER = (*xsubi).into();
     *xsubi = seed16v_ref.into();
     params.reset();
-    BUFFER.as_mut_ptr()
+    &raw mut BUFFER as *mut _
 }
 
 unsafe fn copy_kv(
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/setenv.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setenv(
     key: *const c_char,
     value: *const c_char,
···
 /// The `setkey()` function was marked as obsolescent in the Open Group Base
 /// Specifications Issue 8.
 #[deprecated]
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn setkey(key: *const c_char) {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/initstate.html>.
 // Ported from musl. The state parameter is no longer const in newer versions of POSIX.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setstate(state: *mut c_char) -> *mut c_char {
     let mut random_state = random::state_lock();
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/rand.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn srand(seed: c_uint) {
     RNG = Some(XorShiftRng::from_seed([seed as u8; 16]));
 }
···
 /// # Panics
 /// Panics if the function is unable to obtain a lock on the generator's global
 /// state.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn srand48(seedval: c_long) {
     let mut params = rand48::params_mut();
     let mut xsubi = rand48::xsubi_lock();
···
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/initstate.html>.
 // Ported from musl
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn srandom(seed: c_uint) {
     let mut random_state = random::state_lock();
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strtod.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strtod(s: *const c_char, endptr: *mut *mut c_char) -> c_double {
     strto_float_impl!(c_double, s, endptr)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strtod.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strtof(s: *const c_char, endptr: *mut *mut c_char) -> c_float {
     strto_float_impl!(c_float, s, endptr)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strtol.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strtol(s: *const c_char, endptr: *mut *mut c_char, base: c_int) -> c_long {
     strto_impl!(
         c_long,
···
 // TODO: strtold(), when long double is available
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strtol.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strtoll(
     s: *const c_char,
     endptr: *mut *mut c_char,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strtoul.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strtoul(
     s: *const c_char,
     endptr: *mut *mut c_char,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strtoul.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strtoull(
     s: *const c_char,
     endptr: *mut *mut c_char,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/system.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn system(command: *const c_char) -> c_int {
     // TODO: rusty error handling?
     //TODO: share code with popen
···
 /// The `ttyslot()` function was marked as obsolescent in the Open Group Base
 /// Specifications Issue 5, and the function was removed in Issue 6.
 #[deprecated]
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn ttyslot() -> c_int {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/unlockpt.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn unlockpt(fildes: c_int) -> c_int {
     let mut u: c_int = 0;
     ioctl(fildes, TIOCSPTLCK, &mut u as *mut i32 as *mut c_void)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/unsetenv.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn unsetenv(key: *const c_char) -> c_int {
     if let Some((i, _)) = find_env(key) {
-        if platform::environ == platform::OUR_ENVIRON.as_mut_ptr() {
+        if platform::environ == platform::OUR_ENVIRON.unsafe_mut().as_mut_ptr() {
             // No need to worry about updating the pointer, this does not
             // reallocate in any way. And the final null is already shifted back.
-            platform::OUR_ENVIRON.remove(i);
+            {
+                let mut our_environ = &mut *platform::OUR_ENVIRON.as_mut_ptr();
+                our_environ.remove(i);
+            }
 
             // My UB paranoia.
-            platform::environ = platform::OUR_ENVIRON.as_mut_ptr();
+            platform::environ = platform::OUR_ENVIRON.unsafe_mut().as_mut_ptr();
         } else {
-            platform::OUR_ENVIRON.clear();
-            platform::OUR_ENVIRON.extend(
-                platform::environ_iter()
-                    .enumerate()
-                    .filter(|&(j, _)| j != i)
-                    .map(|(_, v)| v),
-            );
-            platform::OUR_ENVIRON.push(core::ptr::null_mut());
-            platform::environ = platform::OUR_ENVIRON.as_mut_ptr();
+            {
+                let mut our_environ = &mut *platform::OUR_ENVIRON.as_mut_ptr();
+                our_environ.clear();
+                our_environ.extend(
+                    platform::environ_iter()
+                        .enumerate()
+                        .filter(|&(j, _)| j != i)
+                        .map(|(_, v)| v),
+                );
+                our_environ.push(core::ptr::null_mut());
+            }
+            platform::environ = platform::OUR_ENVIRON.unsafe_mut().as_mut_ptr();
         }
     }
     0
···
 /// The `valloc()` function was marked as obsolescent in the Open Group Base
 /// Specifications Issue 5, and the function was removed in Issue 6.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn valloc(size: size_t) -> *mut c_void {
     /* sysconf(_SC_PAGESIZE) is a c_long and may in principle not
      * convert correctly to a size_t. */
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/wcstombs.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcstombs(s: *mut c_char, mut pwcs: *const wchar_t, n: size_t) -> size_t {
     let mut state: mbstate_t = mbstate_t {};
     wcsrtombs(s, &mut pwcs, n, &mut state)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/wctomb.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wctomb(s: *mut c_char, wc: wchar_t) -> c_int {
     let mut state: mbstate_t = mbstate_t {};
     let result: usize = wcrtomb(s, wc, &mut state);

src/header/stdlib/rand48.rs

···
 use crate::{
     platform::types::*,
     sync::{
-        rwlock::{self, RwLock},
         Mutex, MutexGuard,
+        rwlock::{self, RwLock},
     },
 };
 

src/header/string/mod.rs

···
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/string.h.html>.
 
 use core::{
-    iter::{once, zip},
+    iter::once,
     mem::{self, MaybeUninit},
     ptr, slice, usize,
 };
···
     header::{errno::*, signal},
     iter::{NulTerminated, NulTerminatedInclusive, SrcDstPtrIter},
     platform::{self, types::*},
+    raw_cell::RawCell,
 };
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/memccpy.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn memccpy(
     dest: *mut c_void,
     src: *const c_void,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/memchr.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn memchr(
     haystack: *const c_void,
     needle: c_int,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/memcmp.html>.
-#[no_mangle]
-#[no_mangle]
+#[unsafe(no_mangle)]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn memcmp(s1: *const c_void, s2: *const c_void, n: usize) -> c_int {
     let (div, rem) = (n / mem::size_of::<usize>(), n % mem::size_of::<usize>());
     let mut a = s1 as *const usize;
···
 ///     - `s1` is convertible to a `&mut [MaybeUninit<u8>]` with length `n`,
 ///       and
 ///     - `s2` is convertible to a `&[MaybeUninit<u8>]` with length `n`.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn memcpy(s1: *mut c_void, s2: *const c_void, n: size_t) -> *mut c_void {
-    // Avoid creating slices for n == 0. This is because we are required to
-    // avoid UB for n == 0, even if either s1 or s2 is null, to comply with the
-    // expectations of Rust's core library, as well as C2y (N3322).
-    // See https://doc.rust-lang.org/core/index.html for details.
-    if n != 0 {
-        // SAFETY: the caller is required to ensure that the provided pointers
-        // are valid. The slices are required to have a length of at most
-        // isize::MAX; this implicitly ensured by requiring valid pointers to
-        // two nonoverlapping slices.
-        let s1_slice = unsafe { slice::from_raw_parts_mut(s1.cast::<MaybeUninit<u8>>(), n) };
-        let s2_slice = unsafe { slice::from_raw_parts(s2.cast::<MaybeUninit<u8>>(), n) };
-
-        // At this point, it may seem tempting to use
-        // s1_slice.copy_from_slice(s2_slice) here, but memcpy is one of the
-        // handful of symbols whose existence is assumed by Rust's core
-        // library, and thus we need to be careful here not to rely on any
-        // function that calls memcpy internally.
-        // See https://doc.rust-lang.org/core/index.html for details.
-        //
-        // Instead, we check the alignment of the two slices and try to
-        // identify the largest Rust primitive type that is well-aligned for
-        // copying in chunks. s1_slice and s2_slice will be divided into
-        // (prefix, middle, suffix), where only the "middle" part is copyable
-        // using the larger primitive type.
-        let s1_addr = s1.addr();
-        let s2_addr = s2.addr();
-        // Find the number of similar trailing bits in the two addresses to let
-        // us find the largest possible chunk size
-        let equal_trailing_bits_count = (s1_addr ^ s2_addr).trailing_zeros();
-        let chunk_size = match equal_trailing_bits_count {
-            0 => 1,
-            1 => 2,
-            2 => 4,
-            3 => 8,
-            _ => 16, // use u128 chunks for any higher alignments
-        };
-        let chunk_align_offset = s1.align_offset(chunk_size);
-        let prefix_len = chunk_align_offset.min(n);
-
-        // Copy "prefix" bytes
-        for (s1_elem, s2_elem) in zip(&mut s1_slice[..prefix_len], &s2_slice[..prefix_len]) {
-            *s1_elem = *s2_elem;
-        }
-
-        if chunk_align_offset < n {
-            fn copy_chunks_and_remainder<const N: usize, T: Copy>(
-                dst: &mut [MaybeUninit<u8>],
-                src: &[MaybeUninit<u8>],
-            ) {
-                // Check sanity
-                assert_eq!(N, mem::size_of::<T>());
-                assert_eq!(0, N % mem::align_of::<T>());
-                assert!(dst.as_mut_ptr().is_aligned_to(N));
-                assert!(src.as_ptr().is_aligned_to(N));
-
-                // Split into "middle" and "suffix"
-                let (dst_chunks, dst_remainder) = dst.as_chunks_mut::<N>();
-                let (src_chunks, src_remainder) = src.as_chunks::<N>();
-
-                // Copy "middle"
-                for (dst_chunk, src_chunk) in zip(dst_chunks, src_chunks) {
-                    // SAFETY: the chunks are safely subsliced from s1 and
-                    // s2. Alignment is ensured through the use of
-                    // "align_offset", while the size of the chunks is
-                    // explicitly taken to match the primitive size.
-                    let dst_chunk_primitive: &mut MaybeUninit<T> =
-                        unsafe { &mut *dst_chunk.as_mut_ptr().cast() };
-                    let src_chunk_primitive: &MaybeUninit<T> =
-                        unsafe { &*src_chunk.as_ptr().cast() };
-                    *dst_chunk_primitive = *src_chunk_primitive;
-                }
-
-                // Copy "suffix"
-                for (dst_elem, src_elem) in zip(dst_remainder, src_remainder) {
-                    *dst_elem = *src_elem;
-                }
-            }
-
-            // Copy "middle" bytes (if length is sufficient) and any remaining
-            // "suffix" bytes.
-            let s1_middle_and_suffix = &mut s1_slice[prefix_len..];
-            let s2_middle_and_suffix = &s2_slice[prefix_len..];
-            match chunk_size {
-                1 => {
-                    for (s1_elem, s2_elem) in zip(s1_middle_and_suffix, s2_middle_and_suffix) {
-                        *s1_elem = *s2_elem;
-                    }
-                }
-                2 => {
-                    copy_chunks_and_remainder::<2, u16>(s1_middle_and_suffix, s2_middle_and_suffix)
-                }
-                4 => {
-                    copy_chunks_and_remainder::<4, u32>(s1_middle_and_suffix, s2_middle_and_suffix)
-                }
-                8 => {
-                    copy_chunks_and_remainder::<8, u64>(s1_middle_and_suffix, s2_middle_and_suffix)
-                }
-                16 => copy_chunks_and_remainder::<16, u128>(
-                    s1_middle_and_suffix,
-                    s2_middle_and_suffix,
-                ),
-                _ => unreachable!(),
-            }
-        }
+    for i in 0..n {
+        *(s1 as *mut u8).add(i) = *(s2 as *const u8).add(i);
     }
-
     s1
 }
 
···
 /// The caller must ensure that:
 /// - `haystack` is convertible to a `&[u8]` with length `haystacklen`, and
 /// - `needle` is convertible to a `&[u8]` with length `needlelen`.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn memmem(
     haystack: *const c_void,
     haystacklen: size_t,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/memmove.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn memmove(s1: *mut c_void, s2: *const c_void, n: size_t) -> *mut c_void {
     if s2 < s1 as *const c_void {
         // copy from end
···
 }
 
 /// Non-POSIX, see <https://www.man7.org/linux/man-pages/man3/memchr.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn memrchr(
     haystack: *const c_void,
     needle: c_int,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/memset.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn memset(s: *mut c_void, c: c_int, n: size_t) -> *mut c_void {
     for i in 0..n {
         *(s as *mut u8).add(i) = c as u8;
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strcpy.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn stpcpy(mut s1: *mut c_char, mut s2: *const c_char) -> *mut c_char {
     loop {
         *s1 = *s2;
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strncpy.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn stpncpy(
     mut s1: *mut c_char,
     mut s2: *const c_char,
···
 }
 
 /// Non-POSIX, see <https://www.man7.org/linux/man-pages/man3/strstr.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strcasestr(haystack: *const c_char, needle: *const c_char) -> *mut c_char {
     inner_strstr(haystack, needle, !32)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strcat.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strcat(s1: *mut c_char, s2: *const c_char) -> *mut c_char {
     strncat(s1, s2, usize::MAX)
 }
···
 /// The caller is required to ensure that `s` is a valid pointer to a buffer
 /// containing at least one nul value. The pointed-to buffer must not be
 /// modified for the duration of the call.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strchr(mut s: *const c_char, c: c_int) -> *mut c_char {
     let c_as_c_char = c as c_char;
 
···
 }
 
 /// Non-POSIX, see <https://man7.org/linux/man-pages/man3/strchr.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strchrnul(s: *const c_char, c: c_int) -> *mut c_char {
     let mut s = s.cast_mut();
     loop {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strcmp.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strcmp(s1: *const c_char, s2: *const c_char) -> c_int {
     strncmp(s1, s2, usize::MAX)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strcoll.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strcoll(s1: *const c_char, s2: *const c_char) -> c_int {
     // relibc has no locale stuff (yet)
     strcmp(s1, s2)
···
 // TODO: strcoll_l
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strcpy.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strcpy(dst: *mut c_char, src: *const c_char) -> *mut c_char {
     let src_iter = unsafe { NulTerminated::new(src).unwrap() };
     let src_dest_iter = unsafe { SrcDstPtrIter::new(src_iter.chain(once(&0)), dst) };
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strcspn.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strcspn(s1: *const c_char, s2: *const c_char) -> size_t {
     inner_strspn(s1, s2, false)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strdup.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strdup(s1: *const c_char) -> *mut c_char {
     strndup(s1, usize::MAX)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strerror.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strerror(errnum: c_int) -> *mut c_char {
     use core::fmt::Write;
 
-    static mut strerror_buf: [u8; STRERROR_MAX] = [0; STRERROR_MAX];
-    let mut w = platform::StringWriter(strerror_buf.as_mut_ptr(), strerror_buf.len());
+    static strerror_buf: RawCell<[u8; STRERROR_MAX]> = RawCell::new([0; STRERROR_MAX]);
+    let mut w = platform::StringWriter(
+        strerror_buf.unsafe_mut().as_mut_ptr(),
+        strerror_buf.unsafe_ref().len(),
+    );
 
     let _ = match STR_ERROR.get(errnum as usize) {
         Some(e) => w.write_str(e),
         None => w.write_fmt(format_args!("Unknown error {}", errnum)),
     };
 
-    strerror_buf.as_mut_ptr() as *mut c_char
+    strerror_buf.unsafe_mut().as_mut_ptr() as *mut c_char
 }
 
 // TODO: strerror_l
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strerror.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strerror_r(errnum: c_int, buf: *mut c_char, buflen: size_t) -> c_int {
     let msg = strerror(errnum);
     let len = strlen(msg);
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strlcat.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strlcat(dst: *mut c_char, src: *const c_char, n: size_t) -> size_t {
     let len = strlen(dst) as isize;
     let d = dst.offset(len);
···
     strlcpy(d, src, n)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strsep(str_: *mut *mut c_char, sep: *const c_char) -> *mut c_char {
     let s = *str_;
     if s.is_null() {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strlcat.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strlcpy(dst: *mut c_char, src: *const c_char, n: size_t) -> size_t {
     let mut i = 0;
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strlen.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strlen(s: *const c_char) -> size_t {
     unsafe { NulTerminated::new(s).unwrap() }.count()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strncat.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strncat(s1: *mut c_char, s2: *const c_char, n: size_t) -> *mut c_char {
     let len = strlen(s1.cast());
     let mut i = 0;
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strncmp.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strncmp(s1: *const c_char, s2: *const c_char, n: size_t) -> c_int {
-    let s1 = slice::from_raw_parts(s1 as *const c_uchar, n);
-    let s2 = slice::from_raw_parts(s2 as *const c_uchar, n);
-
-    for (&a, &b) in s1.iter().zip(s2.iter()) {
-        let val = (a as c_int) - (b as c_int);
+    for i in 0..n {
+        // These must be cast as u8 to have correct comparisons
+        let a = *s1.add(i) as u8;
+        let b = *s2.add(i) as u8;
         if a != b || a == 0 {
-            return val;
+            return (a as c_int) - (b as c_int);
         }
     }
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strncpy.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strncpy(s1: *mut c_char, s2: *const c_char, n: size_t) -> *mut c_char {
     stpncpy(s1, s2, n);
     s1
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strdup.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strndup(s1: *const c_char, size: size_t) -> *mut c_char {
     let len = strnlen(s1, size);
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strlen.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strnlen(s: *const c_char, size: size_t) -> size_t {
     unsafe { NulTerminated::new(s).unwrap() }.take(size).count()
 }
 
 /// Non-POSIX, see <https://en.cppreference.com/w/c/string/byte/strlen>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strnlen_s(s: *const c_char, size: size_t) -> size_t {
-    if s.is_null() {
-        0
-    } else {
-        strnlen(s, size)
-    }
+    if s.is_null() { 0 } else { strnlen(s, size) }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strpbrk.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strpbrk(s1: *const c_char, s2: *const c_char) -> *mut c_char {
     let p = s1.add(strcspn(s1, s2));
     if *p != 0 {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strrchr.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strrchr(s: *const c_char, c: c_int) -> *mut c_char {
     let len = strlen(s) as isize;
     let c = c as c_char;
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strsignal.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strsignal(sig: c_int) -> *mut c_char {
     signal::SIGNAL_STRINGS
         .get(sig as usize)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strspn.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strspn(s1: *const c_char, s2: *const c_char) -> size_t {
     inner_strspn(s1, s2, true)
 }
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strstr.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strstr(haystack: *const c_char, needle: *const c_char) -> *mut c_char {
     inner_strstr(haystack, needle, !0)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strtok.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strtok(s1: *mut c_char, delimiter: *const c_char) -> *mut c_char {
     static mut HAYSTACK: *mut c_char = ptr::null_mut();
-    strtok_r(s1, delimiter, &mut HAYSTACK)
+    strtok_r(s1, delimiter, &raw mut HAYSTACK)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strtok.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strtok_r(
     s: *mut c_char,
     delimiter: *const c_char,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strxfrm.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strxfrm(s1: *mut c_char, s2: *const c_char, n: size_t) -> size_t {
     // relibc has no locale stuff (yet)
     let len = strlen(s2);

src/header/strings/mod.rs

···
 /// The `bcmp()` function was marked legacy in the Open Group Base
 /// Specifications Issue 6, and removed in Issue 7.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn bcmp(first: *const c_void, second: *const c_void, n: size_t) -> c_int {
     unsafe { string::memcmp(first, second, n) }
 }
···
 /// The `bcopy()` function was marked legacy in the Open Group Base
 /// Specifications Issue 6, and removed in Issue 7.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn bcopy(src: *const c_void, dst: *mut c_void, n: size_t) {
     unsafe {
         ptr::copy(src as *const u8, dst as *mut u8, n);
···
 /// The `bzero()` function was marked legacy in the Open Group Base
 /// Specifications Issue 6, and removed in Issue 7.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn bzero(dst: *mut c_void, n: size_t) {
     unsafe {
         ptr::write_bytes(dst as *mut u8, 0, n);
···
 }
 
 /// Non-POSIX, see <https://man7.org/linux/man-pages/man3/bzero.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn explicit_bzero(s: *mut c_void, n: size_t) {
     for i in 0..n {
         unsafe {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/ffs.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn ffs(i: c_int) -> c_int {
     if i == 0 {
         return 0;
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/ffs.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn ffsl(i: c_long) -> c_int {
     if i == 0 {
         return 0;
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/ffs.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn ffsll(i: c_longlong) -> c_int {
     if i == 0 {
         return 0;
···
 /// The `index()` function was marked legacy in the Open Group Base
 /// Specifications Issue 6, and removed in Issue 7.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn index(s: *const c_char, c: c_int) -> *mut c_char {
     unsafe { string::strchr(s, c) }
 }
···
 /// The `rindex()` function was marked legacy in the Open Group Base
 /// Specifications Issue 6, and removed in Issue 7.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn rindex(s: *const c_char, c: c_int) -> *mut c_char {
     unsafe { string::strrchr(s, c) }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strcasecmp.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strcasecmp(s1: *const c_char, s2: *const c_char) -> c_int {
     // SAFETY: the caller must ensure that s1 and s2 point to nul-terminated buffers.
     let s1_iter = unsafe { NulTerminated::new(s1).unwrap() }.chain(once(&0));
···
 
 // TODO: needs locale_t
 // See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strcasecmp.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 /*pub extern "C" fn strcasecmp_l(s1: *const c_char, s2: *const c_char, locale: locale_t) -> c_int {
     unimplemented!();
 }*/
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strcasecmp.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strncasecmp(s1: *const c_char, s2: *const c_char, n: size_t) -> c_int {
     // SAFETY: the caller must ensure that s1 and s2 point to nul-terminated buffers.
     let s1_iter = unsafe { NulTerminated::new(s1).unwrap() }.chain(once(&0));
···
 
 // TODO: needs locale_t
 // See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strcasecmp.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 /*pub extern "C" fn strncasecmp_l(s1: *const c_char, s2: *const c_char, n: size_t, locale: locale_t) -> c_int {
     unimplemented!();
 }*/

src/header/sys_auxv/mod.rs

···
 pub use crate::platform::auxv_defs::*;
 
 /// See <https://www.man7.org/linux/man-pages/man3/getauxval.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getauxval(_t: c_ulong) -> c_ulong {
     0
 }

src/header/sys_epoll/mod.rs

···
 use crate::{
     error::ResultExt,
     header::signal::sigset_t,
-    platform::{types::*, PalEpoll, Sys},
+    platform::{PalEpoll, Sys, types::*},
 };
 
 pub use self::sys::*;
···
     pub data: epoll_data,
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn epoll_create(_size: c_int) -> c_int {
     epoll_create1(0)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn epoll_create1(flags: c_int) -> c_int {
     trace_expr!(
         Sys::epoll_create1(flags).or_minus_one_errno(),
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn epoll_ctl(
     epfd: c_int,
     op: c_int,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn epoll_wait(
     epfd: c_int,
     events: *mut epoll_event,
···
     epoll_pwait(epfd, events, maxevents, timeout, ptr::null())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn epoll_pwait(
     epfd: c_int,
     events: *mut epoll_event,

src/header/sys_file/mod.rs

···
 
 use crate::{
     error::ResultExt,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 
 pub const LOCK_SH: usize = 1;
···
 pub const L_XTND: usize = 2;
 
 /// See <https://man7.org/linux/man-pages/man2/flock.2.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn flock(fd: c_int, operation: c_int) -> c_int {
     Sys::flock(fd, operation).map(|()| 0).or_minus_one_errno()
 }

src/header/sys_ioctl/linux.rs

···
 use crate::{
     error::ResultExt,
-    platform::{types::*, Sys},
+    platform::{Sys, types::*},
 };
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ioctl(fd: c_int, request: c_ulong, out: *mut c_void) -> c_int {
     // TODO: Somehow support varargs to syscall??
     Sys::ioctl(fd, request, out).or_minus_one_errno()

src/header/sys_ioctl/redox.rs

···
         errno::{self, EINVAL},
         fcntl, termios,
     },
-    platform::{self, types::*, Pal, Sys},
+    platform::{self, Pal, Sys, types::*},
 };
 
 use super::winsize;
···
     Ok(0)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ioctl(fd: c_int, request: c_ulong, out: *mut c_void) -> c_int {
     ioctl_inner(fd, request, out).or_minus_one_errno()
 }

src/header/sys_mman/mod.rs

···
     c_str::{CStr, CString},
     error::{Errno, ResultExt},
     header::{fcntl, unistd},
-    platform::{types::*, Pal, Sys, ERRNO},
+    platform::{ERRNO, Pal, Sys, types::*},
 };
 
 pub use self::sys::*;
···
 pub const POSIX_MADV_WONTNEED: c_int = 4;
 
 /// Non-POSIX, see <https://www.man7.org/linux/man-pages/man2/madvise.2.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn madvise(addr: *mut c_void, len: size_t, flags: c_int) -> c_int {
     Sys::madvise(addr, len, flags)
         .map(|()| 0)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mlock.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mlock(addr: *const c_void, len: usize) -> c_int {
     Sys::mlock(addr, len).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mlockall.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mlockall(flags: c_int) -> c_int {
     Sys::mlockall(flags).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mmap.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mmap(
     addr: *mut c_void,
     len: size_t,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mprotect.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mprotect(addr: *mut c_void, len: size_t, prot: c_int) -> c_int {
     Sys::mprotect(addr, len, prot)
         .map(|()| 0)
···
 }
 
 /// Non-POSIX, see <https://www.man7.org/linux/man-pages/man2/mremap.2.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mremap(
     old_address: *mut c_void,
     old_size: usize,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/msync.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn msync(addr: *mut c_void, len: size_t, flags: c_int) -> c_int {
     Sys::msync(addr, len, flags)
         .map(|()| 0)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mlock.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn munlock(addr: *const c_void, len: usize) -> c_int {
     Sys::munlock(addr, len).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mlockall.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn munlockall() -> c_int {
     Sys::munlockall().map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/munmap.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn munmap(addr: *mut c_void, len: size_t) -> c_int {
     Sys::munmap(addr, len).map(|()| 0).or_minus_one_errno()
 }
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/shm_open.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn shm_open(name: *const c_char, oflag: c_int, mode: mode_t) -> c_int {
     let path = shm_path(name);
     fcntl::open(path.as_ptr(), oflag, mode)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/shm_unlink.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn shm_unlink(name: *const c_char) -> c_int {
     let path = shm_path(name);
     unistd::unlink(path.as_ptr())

src/header/sys_procfs/mod.rs

···
 pub type prstatus_t = elf_prstatus;
 pub type prpsinfo_t = elf_prpsinfo;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn _cbindgen_export_procfs(
     a: psaddr_t,
     b: prgregset_t,

src/header/sys_ptrace/mod.rs

···
 
 use crate::{
     error::ResultExt,
-    platform::{types::*, PalPtrace, Sys},
+    platform::{PalPtrace, Sys, types::*},
 };
 use core::ffi::VaList;
 
···
 pub const PTRACE_SYSEMU_SINGLESTEP: c_int = 32;
 
 // Can't use "params: ..." syntax, because... guess what? Cbingen again :(
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ptrace(request: c_int, mut __valist: ...) -> c_int {
     // Musl also just grabs the arguments from the varargs...
     Sys::ptrace(request, __valist.arg(), __valist.arg(), __valist.arg()).or_minus_one_errno()

src/header/sys_random/mod.rs

···
 
 use crate::{
     error::ResultExt,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 
 /// See <https://www.man7.org/linux/man-pages/man2/getrandom.2.html>.
···
 pub const GRND_RANDOM: c_uint = 2;
 
 /// See <https://www.man7.org/linux/man-pages/man2/getrandom.2.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getrandom(buf: *mut c_void, buflen: size_t, flags: c_uint) -> ssize_t {
     Sys::getrandom(
         slice::from_raw_parts_mut(buf as *mut u8, buflen as usize),

src/header/sys_resource/mod.rs

···
     error::ResultExt,
     header::sys_time::timeval,
     out::Out,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 
 // Exported in bits file
···
 pub const PRIO_PGRP: c_int = 1;
 pub const PRIO_USER: c_int = 2;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getpriority(which: c_int, who: id_t) -> c_int {
     let r = Sys::getpriority(which, who).or_minus_one_errno();
     if r < 0 {
···
     20 - r
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setpriority(which: c_int, who: id_t, nice: c_int) -> c_int {
     Sys::setpriority(which, who, nice)
         .map(|()| 0)
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getrlimit(resource: c_int, rlp: *mut rlimit) -> c_int {
     let rlp = Out::nonnull(rlp);
 
···
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setrlimit(resource: c_int, rlp: *const rlimit) -> c_int {
     Sys::setrlimit(resource, rlp)
         .map(|()| 0)
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getrusage(who: c_int, r_usage: *mut rusage) -> c_int {
     Sys::getrusage(who, Out::nonnull(r_usage))
         .map(|()| 0)

src/header/sys_select/mod.rs

···
     header::{
         errno,
         sys_epoll::{
-            epoll_create1, epoll_ctl, epoll_data, epoll_event, epoll_wait, EPOLLERR, EPOLLIN,
-            EPOLLOUT, EPOLL_CLOEXEC, EPOLL_CTL_ADD,
+            EPOLL_CLOEXEC, EPOLL_CTL_ADD, EPOLLERR, EPOLLIN, EPOLLOUT, epoll_create1, epoll_ctl,
+            epoll_data, epoll_event, epoll_wait,
         },
         sys_time::timeval,
     },
···
     count
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn select(
     nfds: c_int,
     readfds: *mut fd_set,

src/header/sys_socket/mod.rs

···
 use crate::{
     error::ResultExt,
     header::sys_uio::iovec,
-    platform::{types::*, PalSocket, Sys},
+    platform::{PalSocket, Sys, types::*},
 };
 
 pub mod constants;
···
     pub l_linger: c_int,
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn _cbindgen_export_linger(linger: linger) {}
 
 #[repr(C)]
···
     pub gid: gid_t,
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn _cbindgen_export_cmsghdr(cmsghdr: cmsghdr) {}
 
 #[repr(C)]
···
     unsafe { ((*mhdr).msg_control as *mut c_uchar).offset((*mhdr).msg_controllen as isize) }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn CMSG_DATA(cmsg: *const cmsghdr) -> *mut c_uchar {
     unsafe { (cmsg as *mut c_uchar).offset(CMSG_ALIGN(mem::size_of::<cmsghdr>()) as isize) }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn CMSG_NXTHDR(mhdr: *const msghdr, cmsg: *const cmsghdr) -> *mut cmsghdr {
     if cmsg.is_null() {
         return CMSG_FIRSTHDR(mhdr);
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn CMSG_FIRSTHDR(mhdr: *const msghdr) -> *mut cmsghdr {
     unsafe {
         if (*mhdr).msg_controllen as usize >= mem::size_of::<cmsghdr>() {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn CMSG_ALIGN(len: size_t) -> size_t {
     (len + mem::size_of::<size_t>() - 1) & !(mem::size_of::<size_t>() - 1)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn CMSG_SPACE(len: c_uint) -> c_uint {
     (CMSG_ALIGN(len as size_t) + CMSG_ALIGN(mem::size_of::<cmsghdr>())) as c_uint
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn CMSG_LEN(length: c_uint) -> c_uint {
     (CMSG_ALIGN(mem::size_of::<cmsghdr>()) + length as usize) as c_uint
 }
 // } These must match C macros in include/bits/sys/socket.h
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn accept(
     socket: c_int,
     address: *mut sockaddr,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn bind(
     socket: c_int,
     address: *const sockaddr,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn connect(
     socket: c_int,
     address: *const sockaddr,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getpeername(
     socket: c_int,
     address: *mut sockaddr,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getsockname(
     socket: c_int,
     address: *mut sockaddr,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getsockopt(
     socket: c_int,
     level: c_int,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn listen(socket: c_int, backlog: c_int) -> c_int {
     Sys::listen(socket, backlog)
         .map(|()| 0)
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn recv(
     socket: c_int,
     buffer: *mut c_void,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn recvfrom(
     socket: c_int,
     buffer: *mut c_void,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn recvmsg(socket: c_int, msg: *mut msghdr, flags: c_int) -> ssize_t {
     Sys::recvmsg(socket, msg, flags)
         .map(|r| r as ssize_t)
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn send(
     socket: c_int,
     message: *const c_void,
···
     sendto(socket, message, length, flags, ptr::null(), 0)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sendmsg(socket: c_int, msg: *const msghdr, flags: c_int) -> ssize_t {
     Sys::sendmsg(socket, msg, flags)
         .map(|w| w as ssize_t)
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sendto(
     socket: c_int,
     message: *const c_void,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setsockopt(
     socket: c_int,
     level: c_int,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn shutdown(socket: c_int, how: c_int) -> c_int {
     Sys::shutdown(socket, how).map(|()| 0).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn socket(domain: c_int, kind: c_int, protocol: c_int) -> c_int {
     trace_expr!(
         Sys::socket(domain, kind, protocol).or_minus_one_errno(),
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn socketpair(
     domain: c_int,
     kind: c_int,

src/header/sys_stat/mod.rs

···
         time::timespec,
     },
     out::Out,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 
 pub const S_IFMT: c_int = 0o0_170_000;
···
     pub _pad: [c_char; 24],
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn chmod(path: *const c_char, mode: mode_t) -> c_int {
     let path = CStr::from_ptr(path);
     Sys::chmod(path, mode).map(|()| 0).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn fchmod(fildes: c_int, mode: mode_t) -> c_int {
     Sys::fchmod(fildes, mode).map(|()| 0).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fchmodat(
     dirfd: c_int,
     path: *const c_char,
···
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fstat(fildes: c_int, buf: *mut stat) -> c_int {
     let buf = Out::nonnull(buf);
     Sys::fstat(fildes, buf).map(|()| 0).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fstatat(
     fildes: c_int,
     path: *const c_char,
···
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn __fxstat(_ver: c_int, fildes: c_int, buf: *mut stat) -> c_int {
     fstat(fildes, buf)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn futimens(fd: c_int, times: *const timespec) -> c_int {
     Sys::futimens(fd, times).map(|()| 0).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn lstat(path: *const c_char, buf: *mut stat) -> c_int {
     let path = CStr::from_ptr(path);
     let buf = Out::nonnull(buf);
···
     res
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mkdir(path: *const c_char, mode: mode_t) -> c_int {
     let path = CStr::from_ptr(path);
     Sys::mkdir(path, mode).map(|()| 0).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mkfifo(path: *const c_char, mode: mode_t) -> c_int {
     let path = CStr::from_ptr(path);
     Sys::mkfifo(path, mode).map(|()| 0).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mknod(path: *const c_char, mode: mode_t, dev: dev_t) -> c_int {
     let path = CStr::from_ptr(path);
     Sys::mknod(path, mode, dev).map(|()| 0).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mknodat(
     dirfd: c_int,
     path: *const c_char,
···
         .or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn stat(file: *const c_char, buf: *mut stat) -> c_int {
     let file = CStr::from_ptr(file);
     let buf = Out::nonnull(buf);
···
     res
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn umask(mask: mode_t) -> mode_t {
     Sys::umask(mask)
 }

src/header/sys_statvfs/mod.rs

···
     error::ResultExt,
     header::fcntl::O_PATH,
     out::Out,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 
 //pub const ST_RDONLY
···
     pub f_namemax: c_ulong,
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fstatvfs(fildes: c_int, buf: *mut statvfs) -> c_int {
     let buf = Out::nonnull(buf);
     Sys::fstatvfs(fildes, buf).map(|()| 0).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn statvfs(file: *const c_char, buf: *mut statvfs) -> c_int {
     let file = CStr::from_ptr(file);
     let buf = Out::nonnull(buf);

src/header/sys_syslog/logger.rs

···
     sync::Mutex,
 };
 
-use bitflags::{bitflags, Flags};
+use bitflags::{Flags, bitflags};
 use chrono::{DateTime, Utc};
 
 use super::{
-    sys::LogFile, LOG_ALERT, LOG_AUTH, LOG_AUTHPRIV, LOG_CONS, LOG_CRIT, LOG_CRON, LOG_DAEMON,
-    LOG_DEBUG, LOG_EMERG, LOG_ERR, LOG_FTP, LOG_INFO, LOG_KERN, LOG_LOCAL0, LOG_LOCAL1, LOG_LOCAL2,
+    LOG_ALERT, LOG_AUTH, LOG_AUTHPRIV, LOG_CONS, LOG_CRIT, LOG_CRON, LOG_DAEMON, LOG_DEBUG,
+    LOG_EMERG, LOG_ERR, LOG_FTP, LOG_INFO, LOG_KERN, LOG_LOCAL0, LOG_LOCAL1, LOG_LOCAL2,
     LOG_LOCAL3, LOG_LOCAL4, LOG_LOCAL5, LOG_LOCAL6, LOG_LOCAL7, LOG_LPR, LOG_MAIL, LOG_MASK,
     LOG_NDELAY, LOG_NEWS, LOG_NOTICE, LOG_NOWAIT, LOG_ODELAY, LOG_PERROR, LOG_PID, LOG_SYSLOG,
-    LOG_UPTO, LOG_USER, LOG_UUCP, LOG_WARNING,
+    LOG_UPTO, LOG_USER, LOG_UUCP, LOG_WARNING, sys::LogFile,
 };
 
 pub(super) static LOGGER: Mutex<LogParams<LogFile>> = Mutex::new(LogParams::new(None));

src/header/sys_syslog/mod.rs

···
 use core::ffi::VaList;
 
 use crate::{c_str::CStr, platform::types::*};
-use logger::{Priority, LOGGER};
+use logger::{LOGGER, Priority};
 
 /// Record the caller's PID in log messages.
 pub const LOG_PID: c_int = 0x01;
···
 pub const LOG_DEBUG: c_int = 7;
 
 /// Create a mask that includes all levels up to a certain priority.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub const extern "C" fn LOG_UPTO(p: c_int) -> c_int {
     (1 << (p + 1)) - 1
 }
 
 /// Create a mask that enables a single priority.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub const extern "C" fn LOG_MASK(p: c_int) -> c_int {
     1 << p
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn setlogmask(mask: c_int) -> c_int {
     let mut params = LOGGER.lock();
     let old = params.mask.bits();
···
     old
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn openlog(ident: *const c_char, opt: c_int, facility: c_int) {
     let ident = unsafe { CStr::from_nullable_ptr(ident) };
     let conf = logger::Config::from_bits_truncate(opt);
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vsyslog(priority: c_int, message: *const c_char, mut ap: VaList) {
     let Some(message) = CStr::from_nullable_ptr(message) else {
         return;
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn syslog(priority: c_int, message: *const c_char, mut __valist: ...) {
     vsyslog(priority, message, __valist.as_va_list());
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn closelog() {
     LOGGER.lock().close();
 }

src/header/sys_time/mod.rs

···
     error::ResultExt,
     header::time::timespec,
     out::Out,
-    platform::{types::*, Pal, PalSignal, Sys},
+    platform::{Pal, PalSignal, Sys, types::*},
 };
 use core::ptr::null;
 
···
 /// The `getitimer()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 7, and removed in Issue 8.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getitimer(which: c_int, value: *mut itimerval) -> c_int {
     Sys::getitimer(which, &mut *value)
         .map(|()| 0)
···
 /// The `gettimeofday()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 7, and removed in Issue 8.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn gettimeofday(tp: *mut timeval, tzp: *mut timezone) -> c_int {
     Sys::gettimeofday(Out::nonnull(tp), Out::nullable(tzp))
         .map(|()| 0)
···
 /// The `setitimer()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 7, and removed in Issue 8.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setitimer(
     which: c_int,
     value: *const itimerval,
···
 /// # Deprecation
 /// The `utimes()` function was marked legacy in the Open Group Base
 /// Specifications Issue 6, and then unmarked in Issue 7.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn utimes(path: *const c_char, times: *const timeval) -> c_int {
     let path = CStr::from_ptr(path);
     // Nullptr is valid here, it means "use current time"

src/header/sys_timeb/mod.rs

···
 /// # Safety
 /// The caller must ensure that `tp` is convertible to a `&mut
 /// MaybeUninit<timeb>`.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ftime(tp: *mut timeb) -> c_int {
     // SAFETY: the caller is required to ensure that the pointer is valid.
     let tp_maybe_uninit = unsafe { NonNull::new_unchecked(tp).as_uninit_mut() };

src/header/sys_times/mod.rs

···
     tms_cstime: clock_t,
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn times(out: *mut tms) -> clock_t {
     Sys::times(out)
 }

src/header/sys_uio/mod.rs

···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn preadv(
     fd: c_int,
     iov: *const iovec,
···
     ret
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pwritev(
     fd: c_int,
     iov: *const iovec,
···
     unistd::pwrite(fd, vec.as_ptr() as *const c_void, vec.len(), offset)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn readv(fd: c_int, iov: *const iovec, iovcnt: c_int) -> ssize_t {
     if iovcnt < 0 || iovcnt > IOV_MAX {
         platform::ERRNO.set(errno::EINVAL);
···
     ret
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn writev(fd: c_int, iov: *const iovec, iovcnt: c_int) -> ssize_t {
     if iovcnt < 0 || iovcnt > IOV_MAX {
         platform::ERRNO.set(errno::EINVAL);

src/header/sys_utsname/mod.rs

···
 
 use crate::{
     error::ResultExt,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 
 pub const UTSLENGTH: usize = 65;
···
     pub domainname: [c_char; UTSLENGTH],
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn uname(uts: *mut utsname) -> c_int {
     Sys::uname(uts).map(|()| 0).or_minus_one_errno()
 }

src/header/sys_wait/mod.rs

···
 
 use crate::{error::ResultExt, out::Out};
 //use header::sys_resource::rusage;
-use crate::platform::{types::*, Pal, Sys};
+use crate::platform::{Pal, Sys, types::*};
 
 pub const WNOHANG: c_int = 1;
 pub const WUNTRACED: c_int = 2;
···
 #[allow(overflowing_literals)]
 pub const __WCLONE: c_int = 0x8000_0000;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wait(stat_loc: *mut c_int) -> pid_t {
     waitpid(!0, stat_loc, 0)
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 // pub unsafe extern "C" fn wait3(
 //     stat_loc: *mut c_int,
 //     options: c_int,
···
 /*
  * TODO: implement idtype_t, id_t, and siginfo_t
  *
- * #[no_mangle]
+ * #[unsafe(no_mangle)]
  * pub unsafe extern "C" fn waitid(
  *     idtype: idtype_t,
  *     id: id_t,
···
  *  }
  */
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn waitpid(pid: pid_t, stat_loc: *mut c_int, options: c_int) -> pid_t {
     Sys::waitpid(pid, Out::nullable(stat_loc), options).or_minus_one_errno()
 }

src/header/termios/mod.rs

···
     pub c_cc: [cc_t; NCCS],
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn tcgetattr(fd: c_int, out: *mut termios) -> c_int {
     sys_ioctl::ioctl(fd, sys_ioctl::TCGETS, out as *mut c_void)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn tcsetattr(fd: c_int, act: c_int, value: *const termios) -> c_int {
     if act < 0 || act > 2 {
         platform::ERRNO.set(errno::EINVAL);
···
 }
 
 #[cfg(target_os = "linux")]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn cfgetispeed(termios_p: *const termios) -> speed_t {
     (*termios_p).__c_ispeed
 }
 
 #[cfg(target_os = "redox")]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn cfgetispeed(termios_p: *const termios) -> speed_t {
     //TODO
     0
 }
 
 #[cfg(target_os = "linux")]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn cfgetospeed(termios_p: *const termios) -> speed_t {
     (*termios_p).__c_ospeed
 }
 
 #[cfg(target_os = "redox")]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn cfgetospeed(termios_p: *const termios) -> speed_t {
     //TODO
     0
 }
 
 #[cfg(target_os = "linux")]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn cfsetispeed(termios_p: *mut termios, speed: speed_t) -> c_int {
     match speed as usize {
         B0..=B38400 | B57600..=B4000000 => {
···
 }
 
 #[cfg(target_os = "redox")]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn cfsetispeed(termios_p: *mut termios, speed: speed_t) -> c_int {
     //TODO
     platform::ERRNO.set(errno::EINVAL);
···
 }
 
 #[cfg(target_os = "linux")]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn cfsetospeed(termios_p: *mut termios, speed: speed_t) -> c_int {
     match speed as usize {
         B0..=B38400 | B57600..=B4000000 => {
···
 }
 
 #[cfg(target_os = "redox")]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn cfsetospeed(termios_p: *mut termios, speed: speed_t) -> c_int {
     //TODO
     platform::ERRNO.set(errno::EINVAL);
     -1
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn cfsetspeed(termios_p: *mut termios, speed: speed_t) -> c_int {
     let r = cfsetispeed(termios_p, speed);
     if r < 0 {
···
     cfsetospeed(termios_p, speed)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn tcflush(fd: c_int, queue: c_int) -> c_int {
     sys_ioctl::ioctl(fd, sys_ioctl::TCFLSH, queue as *mut c_void)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn tcdrain(fd: c_int) -> c_int {
     sys_ioctl::ioctl(fd, sys_ioctl::TCSBRK, 1 as *mut _)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn tcsendbreak(fd: c_int, _dur: c_int) -> c_int {
     // non-zero duration is ignored by musl due to it being
     // implementation-defined. we do the same.
     sys_ioctl::ioctl(fd, sys_ioctl::TCSBRK, 0 as *mut _)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn tcsetwinsize(fd: c_int, mut sws: winsize) -> c_int {
     sys_ioctl::ioctl(fd, sys_ioctl::TIOCSWINSZ, &mut sws as *mut _ as *mut c_void)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn tcflow(fd: c_int, action: c_int) -> c_int {
     // non-zero duration is ignored by musl due to it being
     // implementation-defined. we do the same.
     sys_ioctl::ioctl(fd, sys_ioctl::TCXONC, action as *mut _)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn cfmakeraw(termios_p: *mut termios) {
     (*termios_p).c_iflag &=
         !(IGNBRK | BRKINT | PARMRK | ISTRIP | INLCR | IGNCR | ICRNL | IXON) as u32;

src/header/time/mod.rs

···
     header::{errno::EOVERFLOW, fcntl::O_RDONLY, stdlib::getenv, unistd::readlink},
     io::Read,
     out::Out,
-    platform::{self, types::*, Pal, Sys},
+    platform::{self, Pal, Sys, types::*},
     sync::{Mutex, MutexGuard},
 };
 use alloc::{boxed::Box, collections::BTreeSet, string::String, vec::Vec};
 use chrono::{
-    format::ParseErrorKind, offset::MappedLocalTime, DateTime, Datelike, FixedOffset, NaiveDate,
-    NaiveDateTime, Offset, ParseError, TimeZone, Timelike, Utc,
+    DateTime, Datelike, FixedOffset, NaiveDate, NaiveDateTime, Offset, ParseError, TimeZone,
+    Timelike, Utc, format::ParseErrorKind, offset::MappedLocalTime,
 };
 use chrono_tz::{OffsetComponents, OffsetName, Tz};
 use core::{
···
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/time.h.html>.
 #[allow(non_upper_case_globals)]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub static mut daylight: c_int = 0;
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/time.h.html>.
 #[allow(non_upper_case_globals)]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub static mut timezone: c_long = 0;
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/time.h.html>.
 #[allow(non_upper_case_globals)]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub static mut tzname: TzName = TzName([ptr::null_mut(); 2]);
 
 #[allow(non_upper_case_globals)]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub static mut getdate_err: c_int = 0;
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/time.h.html>.
···
 /// The `asctime()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 7.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn asctime(timeptr: *const tm) -> *mut c_char {
-    asctime_r(timeptr, ASCTIME.as_mut_ptr().cast())
+    asctime_r(timeptr, &raw mut ASCTIME as *mut _)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9699919799/functions/asctime.html>.
···
 /// The `asctime_r()` was marked obsolescent in the Open Group Base
 /// Specifications Issue 7, and removed in Issue 8.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn asctime_r(tm: *const tm, buf: *mut c_char) -> *mut c_char {
     let tm_sec = (*tm).tm_sec;
     let tm_min = (*tm).tm_min;
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn clock() -> clock_t {
     let mut ts = mem::MaybeUninit::<timespec>::uninit();
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_getcpuclockid.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn clock_getcpuclockid(pid: pid_t, clock_id: *mut clockid_t) -> c_int {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_getres.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn clock_getres(clock_id: clockid_t, res: *mut timespec) -> c_int {
     Sys::clock_getres(clock_id, Out::nullable(res))
         .map(|()| 0)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_getres.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn clock_gettime(clock_id: clockid_t, tp: *mut timespec) -> c_int {
     Sys::clock_gettime(clock_id, Out::nonnull(tp))
         .map(|()| 0)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_nanosleep.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn clock_nanosleep(
     clock_id: clockid_t,
     flags: c_int,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/clock_getres.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn clock_settime(clock_id: clockid_t, tp: *const timespec) -> c_int {
     Sys::clock_settime(clock_id, tp)
         .map(|()| 0)
···
 /// The `ctime()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 7.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ctime(clock: *const time_t) -> *mut c_char {
     asctime(localtime(clock))
 }
···
 /// The `ctime_r()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 7, and removed in Issue 8.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ctime_r(clock: *const time_t, buf: *mut c_char) -> *mut c_char {
     // Using MaybeUninit<tm> seems to cause a panic during the build process
     let mut tm1 = blank_tm();
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/difftime.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn difftime(time1: time_t, time0: time_t) -> c_double {
     (time1 - time0) as _
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getdate.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn getdate(string: *const c_char) -> *const tm {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/gmtime.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn gmtime(timer: *const time_t) -> *mut tm {
-    gmtime_r(timer, &mut TM)
+    gmtime_r(timer, &raw mut TM)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/gmtime.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn gmtime_r(clock: *const time_t, result: *mut tm) -> *mut tm {
     let _ = get_localtime(*clock, result);
     result
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/localtime.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn localtime(clock: *const time_t) -> *mut tm {
-    localtime_r(clock, &mut TM)
+    localtime_r(clock, &raw mut TM)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/localtime.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn localtime_r(clock: *const time_t, t: *mut tm) -> *mut tm {
     let mut lock = TIMEZONE_LOCK.lock();
     clear_timezone(&mut lock);
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/mktime.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mktime(timeptr: *mut tm) -> time_t {
     let mut lock = TIMEZONE_LOCK.lock();
     clear_timezone(&mut lock);
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/nanosleep.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn nanosleep(rqtp: *const timespec, rmtp: *mut timespec) -> c_int {
     Sys::nanosleep(rqtp, rmtp).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strftime.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strftime(
     s: *mut c_char,
     maxsize: size_t,
···
         format,
         timeptr,
     );
-    if ret < maxsize {
-        ret
-    } else {
-        0
-    }
+    if ret < maxsize { ret } else { 0 }
 }
 
 // See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strftime.html>.
 // TODO: needs locale_t
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 /*pub extern "C" fn strftime_l(s: *mut char, maxsize: size_t, format: *const c_char, timeptr: *const tm, locale: locale_t) -> size_t {
     unimplemented!();
 }*/
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/time.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn time(tloc: *mut time_t) -> time_t {
     let mut ts = timespec::default();
     Sys::clock_gettime(CLOCK_REALTIME, Out::from_mut(&mut ts));
···
 }
 
 /// Non-POSIX, see <https://www.man7.org/linux/man-pages/man3/timegm.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn timegm(tm: *mut tm) -> time_t {
     let tm_val = &mut *tm;
     let dt = match convert_tm_generic(&Utc, tm_val) {
···
 
 /// Non-POSIX, see <https://www.man7.org/linux/man-pages/man3/timegm.3.html>.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn timelocal(tm: *mut tm) -> time_t {
     let tm_val = &mut *tm;
     let tz = time_zone();
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/timer_create.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn timer_create(
     clock_id: clockid_t,
     evp: *mut sigevent,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/timer_delete.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn timer_delete(timerid: timer_t) -> c_int {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/timer_getoverrun.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn timer_getoverrun(timerid: timer_t) -> c_int {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/timer_getoverrun.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn timer_gettime(timerid: timer_t, value: *mut itimerspec) -> c_int {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/timer_getoverrun.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn timer_settime(
     timerid: timer_t,
     flags: c_int,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/timespec_get.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn timespec_get(ts: *mut timespec, base: c_int) -> c_int {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/tzset.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn tzset() {
     let mut lock = TIMEZONE_LOCK.lock();
     unsafe { clear_timezone(&mut lock) };

src/header/time/strftime.rs

···
 use super::{get_offset, tm};
 use crate::{
     c_str::CStr,
-    platform::{self, types::*, WriteByte},
+    platform::{self, WriteByte, types::*},
 };
 
 // We use the langinfo constants
 use crate::header::langinfo::{
-    nl_item,
-    nl_langinfo,
     ABDAY_1,
     ABMON_1,
     AM_STR,
···
     MON_1,
     PM_STR,
     // TODO : other constants if needed
+    nl_item,
+    nl_langinfo,
 };
 
 /// A helper that calls `nl_langinfo(item)` and converts the returned pointer
···
 fn weeks_per_year(year: c_int) -> c_int {
     let year = year as f64;
     let p_y = (year + (year / 4.) - (year / 100.) + (year / 400.)) as c_int % 7;
-    if p_y == 4 {
-        53
-    } else {
-        52
-    }
+    if p_y == 4 { 53 } else { 52 }
 }
 
 /// Calculate the week of the year accounting for leap weeks (ISO 8601)

src/header/time/strptime.rs

···
 };
 use alloc::{string::String, vec::Vec};
 use core::{
-    ffi::{c_char, c_int, c_void, CStr},
+    ffi::{CStr, c_char, c_int, c_void},
     mem::MaybeUninit,
     ptr,
     ptr::NonNull,
···
 ];
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strptime.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn strptime(
     buf: *const c_char,
     format: *const c_char,
···
         }
     }
 
-    if count == 0 {
-        None
-    } else {
-        Some((val, count))
-    }
+    if count == 0 { None } else { Some((val, count)) }
 }
 
 /// Handle AM/PM. Returns (is_pm, length_consumed).

src/header/unistd/brk.rs

···
 use crate::{
     error::ResultExtPtrMut,
     header::errno::ENOMEM,
-    platform::{self, types::*, Pal, Sys},
+    platform::{self, Pal, Sys, types::*},
 };
 
 static mut BRK: *mut c_void = ptr::null_mut();
···
 /// The `brk()` function was marked legacy in the System Interface & Headers
 /// Issue 5, and removed in Issue 6.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn brk(addr: *mut c_void) -> c_int {
     BRK = Sys::brk(addr).or_errno_null_mut();
 
···
 /// The `sbrk()` function was marked legacy in the System Interface & Headers
 /// Issue 5, and removed in Issue 6.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sbrk(incr: intptr_t) -> *mut c_void {
     if BRK.is_null() {
         BRK = Sys::brk(ptr::null_mut()).or_errno_null_mut();

src/header/unistd/getopt.rs

···
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getopt.html>.
 #[allow(non_upper_case_globals)]
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[linkage = "weak"] // often redefined in GNU programs
 pub static mut optarg: *mut c_char = ptr::null_mut();
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getopt.html>.
 #[allow(non_upper_case_globals)]
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[linkage = "weak"] // often redefined in GNU programs
 pub static mut opterr: c_int = 1;
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getopt.html>.
 #[allow(non_upper_case_globals)]
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[linkage = "weak"] // often redefined in GNU programs
 pub static mut optind: c_int = 1;
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getopt.html>.
 #[allow(non_upper_case_globals)]
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[linkage = "weak"] // often redefined in GNU programs
 pub static mut optopt: c_int = -1;
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getopt.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 #[linkage = "weak"] // often redefined in GNU programs
 pub unsafe extern "C" fn getopt(
     argc: c_int,

src/header/unistd/getpass.rs

···
         termios,
     },
     io::{self, Read, Write},
+    raw_cell::RawCell,
 };
 
 use crate::platform::types::*;
···
 /// The `getpass()` function was marked legacy in the Open Group System
 /// Interface & Headers Issue 5, and removed in Issue 6.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getpass(prompt: *const c_char) -> *mut c_char {
-    static mut PASSBUFF: [u8; PASS_MAX] = [0; PASS_MAX];
+    static PASSBUFF: RawCell<[u8; PASS_MAX]> = RawCell::new([0; PASS_MAX]);
 
-    unsafe { getpass_rs(CStr::from_ptr(prompt), &mut PASSBUFF).unwrap_or(ptr::null_mut()) }
+    unsafe {
+        getpass_rs(CStr::from_ptr(prompt), &mut *PASSBUFF.as_mut_ptr()).unwrap_or(ptr::null_mut())
+    }
 }

src/header/unistd/mod.rs

···
         time::timespec,
     },
     out::Out,
-    platform::{self, types::*, Pal, Sys, ERRNO},
+    platform::{self, ERRNO, Pal, Sys, types::*},
 };
 
 pub use self::{brk::*, getopt::*, getpass::getpass, pathconf::*, sysconf::*};
···
 
 // Re-exported from pthread.h. `pthread_atfork` should be in pthread.h according to the
 // standard, but glibc exports it here as well. We ONLY exported it in unistd.h till recently.
-extern "C" {
-    #[no_mangle]
+unsafe extern "C" {
+    #[unsafe(no_mangle)]
     pub fn pthread_atfork(
         prepare: Option<extern "C" fn()>,
         parent: Option<extern "C" fn()>,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/fork.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub unsafe extern "C" fn _Fork() -> pid_t {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/_Exit.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn _exit(status: c_int) -> ! {
     Sys::exit(status)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/access.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn access(path: *const c_char, mode: c_int) -> c_int {
     let path = CStr::from_ptr(path);
     Sys::access(path, mode).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/alarm.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn alarm(seconds: c_uint) -> c_uint {
     // TODO setitimer is unimplemented on Redox and obsolete
     let mut timer = sys_time::itimerval {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/chdir.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn chdir(path: *const c_char) -> c_int {
     let path = CStr::from_ptr(path);
     Sys::chdir(path).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/chown.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn chown(path: *const c_char, owner: uid_t, group: gid_t) -> c_int {
     let path = CStr::from_ptr(path);
     Sys::chown(path, owner, group)
···
 /// The `chroot()` function was marked legacy in the System Interface & Headers
 /// Issue 5, and removed in Issue 6.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn chroot(path: *const c_char) -> c_int {
     // TODO: Implement
     platform::ERRNO.set(crate::header::errno::EPERM);
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/close.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn close(fildes: c_int) -> c_int {
     Sys::close(fildes).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/confstr.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn confstr(name: c_int, buf: *mut c_char, len: size_t) -> size_t {
     // confstr returns the number of bytes required to hold the string INCLUDING the NUL
     // terminator. This is different from other C functions hence the + 1.
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/crypt.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn crypt(key: *const c_char, salt: *const c_char) -> *mut c_char {
     let mut data = crypt_data::new();
     crypt_r(key, salt, &mut data as *mut _)
 }
 
 /// Non-POSIX, see <https://www.man7.org/linux/man-pages/man3/daemon.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn daemon(nochdir: c_int, noclose: c_int) -> c_int {
     if nochdir == 0 {
         if Sys::chdir(c"/".into()).map(|()| 0).or_minus_one_errno() < 0 {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/dup.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn dup(fildes: c_int) -> c_int {
     Sys::dup(fildes).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/dup.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn dup2(fildes: c_int, fildes2: c_int) -> c_int {
     Sys::dup2(fildes, fildes2).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/dup.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn dup3(fildes: c_int, fildes2: c_int, flag: c_int) -> c_int {
     unimplemented!();
 }
···
 /// # Deprecation
 /// The `encrypt()` function was marked obsolescent in the Open Group Base Specifications Issue 8.
 #[deprecated]
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn encrypt(block: [c_char; 64], edflag: c_int) {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/exec.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn execl(
     path: *const c_char,
     arg0: *const c_char,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/exec.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn execle(
     path: *const c_char,
     arg0: *const c_char,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/exec.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn execlp(
     file: *const c_char,
     arg0: *const c_char,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/exec.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn execv(path: *const c_char, argv: *const *mut c_char) -> c_int {
     execve(path, argv, platform::environ)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/exec.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn execve(
     path: *const c_char,
     argv: *const *mut c_char,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/exec.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fexecve(
     fd: c_int,
     argv: *const *mut c_char,
···
 const PATH_SEPARATOR: u8 = b':';
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/exec.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn execvp(file: *const c_char, argv: *const *mut c_char) -> c_int {
     let file = CStr::from_ptr(file);
 
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/fchdir.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn fchdir(fildes: c_int) -> c_int {
     Sys::fchdir(fildes).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/fchown.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn fchown(fildes: c_int, owner: uid_t, group: gid_t) -> c_int {
     Sys::fchown(fildes, owner, group)
         .map(|()| 0)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/fdatasync.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn fdatasync(fildes: c_int) -> c_int {
     Sys::fdatasync(fildes).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/fork.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fork() -> pid_t {
     for prepare in &fork_hooks[0] {
         prepare();
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/fsync.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn fsync(fildes: c_int) -> c_int {
     Sys::fsync(fildes).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/ftruncate.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn ftruncate(fildes: c_int, length: off_t) -> c_int {
     Sys::ftruncate(fildes, length)
         .map(|()| 0)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getcwd.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getcwd(mut buf: *mut c_char, mut size: size_t) -> *mut c_char {
     let alloc = buf.is_null();
     let mut stack_buf = [0; limits::PATH_MAX];
···
 /// The `getdtablesize()` function was marked legacy in the System Interface &
 /// Headers Issue 5, and removed in Issue 6.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getdtablesize() -> c_int {
     let mut lim = mem::MaybeUninit::<sys_resource::rlimit>::uninit();
     let r = unsafe {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getegid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getegid() -> gid_t {
     Sys::getegid()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getentropy.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn getentropy(buffer: *mut c_void, length: size_t) -> c_int {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/geteuid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn geteuid() -> uid_t {
     Sys::geteuid()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getgid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getgid() -> gid_t {
     Sys::getgid()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getgroups.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getgroups(size: c_int, list: *mut gid_t) -> c_int {
     (|| {
         let size = usize::try_from(size)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/gethostid.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn gethostid() -> c_long {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/gethostname.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn gethostname(mut name: *mut c_char, mut len: size_t) -> c_int {
     let mut uts = mem::MaybeUninit::<sys_utsname::utsname>::uninit();
     // TODO
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getlogin.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getlogin() -> *mut c_char {
-    static mut LOGIN: [c_char; 256] = [0; 256];
-    if getlogin_r(LOGIN.as_mut_ptr(), LOGIN.len()) == 0 {
-        LOGIN.as_mut_ptr()
+    const LOGIN_LEN: usize = 256;
+    static mut LOGIN: [c_char; LOGIN_LEN] = [0; LOGIN_LEN];
+    if getlogin_r(&raw mut LOGIN as *mut _, LOGIN_LEN) == 0 {
+        &raw mut LOGIN as *mut _
     } else {
         ptr::null_mut()
     }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getlogin.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getlogin_r(name: *mut c_char, namesize: size_t) -> c_int {
     //TODO: Determine correct getlogin result on Redox
     platform::ERRNO.set(errno::ENOENT);
···
 /// The `getpagesize()` function was marked legacy in the System Interface &
 /// Headers Issue 5, and removed in Issue 6.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getpagesize() -> c_int {
     // Panic if we can't uphold the required behavior (no errors are specified for this function)
     Sys::getpagesize()
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getpgid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getpgid(pid: pid_t) -> pid_t {
     Sys::getpgid(pid).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getpgrp.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getpgrp() -> pid_t {
     Sys::getpgid(Sys::getpid()).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getpid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getpid() -> pid_t {
     Sys::getpid()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getppid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getppid() -> pid_t {
     Sys::getppid()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getresgid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getresgid(rgid: *mut gid_t, egid: *mut gid_t, sgid: *mut gid_t) -> c_int {
     Sys::getresgid(
         Out::nullable(rgid),
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getresuid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getresuid(ruid: *mut uid_t, euid: *mut uid_t, suid: *mut uid_t) -> c_int {
     Sys::getresuid(
         Out::nullable(ruid),
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getsid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getsid(pid: pid_t) -> pid_t {
     Sys::getsid(pid).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getuid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn getuid() -> uid_t {
     Sys::getuid()
 }
···
 /// The `getwd()` function was marked legacy in the Open Group Base
 /// Specifications Issue 6, and removed in Issue 7.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getwd(path_name: *mut c_char) -> *mut c_char {
     unsafe { getcwd(path_name, limits::PATH_MAX) }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/isatty.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn isatty(fd: c_int) -> c_int {
     let mut t = termios::termios::default();
     if unsafe { termios::tcgetattr(fd, &mut t as *mut termios::termios) == 0 } {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/lchown.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn lchown(path: *const c_char, owner: uid_t, group: gid_t) -> c_int {
     let path = CStr::from_ptr(path);
     Sys::lchown(path, owner, group)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/link.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn link(path1: *const c_char, path2: *const c_char) -> c_int {
     let path1 = CStr::from_ptr(path1);
     let path2 = CStr::from_ptr(path2);
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/lockf.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn lockf(fildes: c_int, function: c_int, size: off_t) -> c_int {
     let mut fl = fcntl::flock {
         l_type: fcntl::F_WRLCK as c_short,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/lseek.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn lseek(fildes: c_int, offset: off_t, whence: c_int) -> off_t {
     Sys::lseek(fildes, offset, whence).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/nice.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn nice(incr: c_int) -> c_int {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/pause.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn pause() -> c_int {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/pipe.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pipe(fildes: *mut c_int) -> c_int {
     pipe2(fildes, 0)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/pipe.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pipe2(fildes: *mut c_int, flags: c_int) -> c_int {
     Sys::pipe2(Out::nonnull(fildes.cast::<[c_int; 2]>()), flags)
         .map(|()| 0)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/close.html>.
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn posix_close(fildes: c_int, flag: c_int) -> c_int {
     unimplemented!();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/read.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pread(
     fildes: c_int,
     buf: *mut c_void,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/write.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn pwrite(
     fildes: c_int,
     buf: *const c_void,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/read.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn read(fildes: c_int, buf: *const c_void, nbyte: size_t) -> ssize_t {
     let buf = unsafe { slice::from_raw_parts_mut(buf as *mut u8, nbyte as usize) };
     trace_expr!(
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/readlink.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn readlink(
     path: *const c_char,
     buf: *mut c_char,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/readlink.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn readlinkat(
     dirfd: c_int,
     pathname: *const c_char,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/rmdir.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn rmdir(path: *const c_char) -> c_int {
     let path = CStr::from_ptr(path);
     Sys::rmdir(path).map(|()| 0).or_minus_one_errno()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn set_default_scheme(scheme: *const c_char) -> c_int {
     let scheme = CStr::from_ptr(scheme);
     Sys::set_default_scheme(scheme)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/setegid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn setegid(gid: gid_t) -> c_int {
     Sys::setresgid(-1, gid, -1).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/seteuid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn seteuid(uid: uid_t) -> c_int {
     Sys::setresuid(-1, uid, -1).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/setgid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn setgid(gid: gid_t) -> c_int {
     Sys::setresgid(gid, gid, -1)
         .map(|()| 0)
···
 /// Non-POSIX, see <https://www.man7.org/linux/man-pages/man2/setgroups.2.html>.
 ///
 /// TODO: specified in `grp.h`?
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn setgroups(size: size_t, list: *const gid_t) -> c_int {
     Sys::setgroups(size, list).map(|()| 0).or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/setpgid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn setpgid(pid: pid_t, pgid: pid_t) -> c_int {
     Sys::setpgid(pid, pgid).map(|()| 0).or_minus_one_errno()
 }
···
 /// The `setpgrp()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 7, and removed in Issue 8.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn setpgrp() -> pid_t {
     setpgid(0, 0)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/setregid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn setregid(rgid: gid_t, egid: gid_t) -> c_int {
     Sys::setresgid(rgid, egid, -1)
         .map(|()| 0)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/setresgid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn setresgid(rgid: gid_t, egid: gid_t, sgid: gid_t) -> c_int {
     Sys::setresgid(rgid, egid, sgid)
         .map(|()| 0)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/setresuid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn setresuid(ruid: uid_t, euid: uid_t, suid: uid_t) -> c_int {
     Sys::setresuid(ruid, euid, suid)
         .map(|()| 0)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/setreuid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn setreuid(ruid: uid_t, euid: uid_t) -> c_int {
     Sys::setresuid(ruid, euid, -1)
         .map(|()| 0)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/setsid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn setsid() -> pid_t {
     Sys::setsid().or_minus_one_errno()
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/setuid.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn setuid(uid: uid_t) -> c_int {
     Sys::setresuid(uid, uid, -1)
         .map(|()| 0)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sleep.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn sleep(seconds: c_uint) -> c_uint {
     let rqtp = timespec {
         tv_sec: seconds as time_t,
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/swab.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn swab(src: *const c_void, dest: *mut c_void, nbytes: ssize_t) {
     if nbytes <= 0 {
         return;
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/symlink.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn symlink(path1: *const c_char, path2: *const c_char) -> c_int {
     let path1 = CStr::from_ptr(path1);
     let path2 = CStr::from_ptr(path2);
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/sync.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn sync() {
     Sys::sync();
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/tcgetpgrp.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn tcgetpgrp(fd: c_int) -> pid_t {
     let mut pgrp = 0;
     if unsafe { sys_ioctl::ioctl(fd, sys_ioctl::TIOCGPGRP, &mut pgrp as *mut pid_t as _) } < 0 {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/tcsetpgrp.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn tcsetpgrp(fd: c_int, pgrp: pid_t) -> c_int {
     if unsafe { sys_ioctl::ioctl(fd, sys_ioctl::TIOCSPGRP, &pgrp as *const pid_t as _) } < 0 {
         return -1;
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/truncate.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn truncate(path: *const c_char, length: off_t) -> c_int {
     let file = unsafe { CStr::from_ptr(path) };
     // TODO: Rustify
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/ttyname.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ttyname(fildes: c_int) -> *mut c_char {
-    static mut TTYNAME: [c_char; 4096] = [0; 4096];
-    if ttyname_r(fildes, TTYNAME.as_mut_ptr(), TTYNAME.len()) == 0 {
-        TTYNAME.as_mut_ptr()
+    const TTYNAME_LEN: usize = 4096;
+    static mut TTYNAME: [c_char; TTYNAME_LEN] = [0; TTYNAME_LEN];
+    if ttyname_r(fildes, &raw mut TTYNAME as *mut _, TTYNAME_LEN) == 0 {
+        &raw mut TTYNAME as *mut _
     } else {
         ptr::null_mut()
     }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/ttyname.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn ttyname_r(fildes: c_int, name: *mut c_char, namesize: size_t) -> c_int {
     let name = unsafe { slice::from_raw_parts_mut(name as *mut u8, namesize) };
     if name.is_empty() {
···
 /// The `ualarm()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 6, and removed in Issue 7.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn ualarm(usecs: useconds_t, interval: useconds_t) -> useconds_t {
     // TODO setitimer is unimplemented on Redox and obsolete
     let mut timer = sys_time::itimerval {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/unlink.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn unlink(path: *const c_char) -> c_int {
     let path = CStr::from_ptr(path);
     Sys::unlink(path).map(|()| 0).or_minus_one_errno()
···
 /// The `usleep()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 6, and removed in Issue 7.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn usleep(useconds: useconds_t) -> c_int {
     let rqtp = timespec {
         tv_sec: (useconds / 1_000_000) as time_t,
···
 /// The `vfork()` function was marked obsolescent in the Open Group Base
 /// Specifications Issue 6, and removed in Issue 7.
 #[deprecated]
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn vfork() -> pid_t {
     unimplemented!();
 }
···
     // NULL
     va.arg::<*const c_char>();
 
-    f(MaybeUninit::slice_assume_init_ref(&*out), va);
+    f((&*out).assume_init_ref(), va);
 
     // f only returns if it fails
     if argc >= 32 {
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/write.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn write(fildes: c_int, buf: *const c_void, nbyte: size_t) -> ssize_t {
     let buf = slice::from_raw_parts(buf as *const u8, nbyte as usize);
     Sys::write(fildes, buf)

src/header/unistd/pathconf.rs

···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/fpathconf.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn fpathconf(_fildes: c_int, name: c_int) -> c_long {
     pc(name)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/fpathconf.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn pathconf(_path: *const c_char, name: c_int) -> c_long {
     pc(name)
 }

src/header/unistd/sysconf.rs

···
 
 use core::ffi::{c_int, c_long};
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn sysconf(name: c_int) -> c_long {
     sysconf_impl(name)
 }

src/header/unistd/sysconf/redox.rs

···
     fs::File,
     header::{errno, fcntl, limits},
     io::Read,
-    platform::{self, types::*, Pal, Sys},
+    platform::{self, Pal, Sys, types::*},
 };
 
 // POSIX.1 {

src/header/utime/mod.rs

···
     c_str::CStr,
     error::ResultExt,
     header::time::timespec,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 
 /// See <https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/utime.h.html>.
···
 
 /// See <https://pubs.opengroup.org/onlinepubs/9699919799/functions/utime.html>.
 #[deprecated]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn utime(filename: *const c_char, times: *const utimbuf) -> c_int {
     let filename_cstr = unsafe { CStr::from_ptr(filename) };
     let times_ref = unsafe { &*times };

src/header/utmp/mod.rs

···
 };
 
 /// See <https://www.man7.org/linux/man-pages/man3/openpty.3.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn login_tty(fd: c_int) -> c_int {
     // Create a new session
     unistd::setsid();

src/header/wchar/lookaheadreader.rs

···
-use super::{fseek_locked, ftell_locked, FILE, SEEK_SET};
+use super::{FILE, SEEK_SET, fseek_locked, ftell_locked};
 use crate::{
     header::{
         errno::EILSEQ,
-        wchar::{fgetwc, get_char_encoded_length, mbrtowc, MB_CUR_MAX},
+        wchar::{MB_CUR_MAX, fgetwc, get_char_encoded_length, mbrtowc},
         wctype::WEOF,
     },
     io::Read,
     platform::{
-        types::{c_char, off_t, wchar_t, wint_t},
         ERRNO,
+        types::{c_char, off_t, wchar_t, wint_t},
     },
 };
 use core::ptr;

src/header/wchar/mod.rs

···
         ctype::isspace,
         errno::{EILSEQ, ENOMEM, ERANGE},
         stdio::*,
-        stdlib::{malloc, MB_CUR_MAX, MB_LEN_MAX},
+        stdlib::{MB_CUR_MAX, MB_LEN_MAX, malloc},
         string,
         time::*,
         wchar::{lookaheadreader::LookAheadReader, utf8::get_char_encoded_length},
         wctype::*,
     },
     iter::{NulTerminated, NulTerminatedInclusive},
-    platform::{self, types::*, ERRNO},
+    platform::{self, ERRNO, types::*},
 };
 
 mod lookaheadreader;
···
 #[derive(Clone, Copy)]
 pub struct mbstate_t;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn btowc(c: c_int) -> wint_t {
     //Check for EOF
     if c == EOF {
···
     wc as wint_t
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fgetwc(stream: *mut FILE) -> wint_t {
     // TODO: Process locale
     let mut buf: [c_uchar; MB_CUR_MAX as usize] = [0; MB_CUR_MAX as usize];
···
     wc as wint_t
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fgetws(ws: *mut wchar_t, n: c_int, stream: *mut FILE) -> *mut wchar_t {
     //TODO: lock
     let mut i = 0;
···
     ws
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fputwc(wc: wchar_t, stream: *mut FILE) -> wint_t {
     //Convert wchar_t to multibytes first
     static mut INTERNAL: mbstate_t = mbstate_t;
     let mut bytes: [c_char; MB_CUR_MAX as usize] = [0; MB_CUR_MAX as usize];
 
-    let amount = wcrtomb(bytes.as_mut_ptr(), wc, &mut INTERNAL);
+    let amount = wcrtomb(bytes.as_mut_ptr(), wc, &raw mut INTERNAL);
 
     for i in 0..amount {
         fputc(bytes[i] as c_int, &mut *stream);
···
     wc as wint_t
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fputws(ws: *const wchar_t, stream: *mut FILE) -> c_int {
     let mut i = 0;
     loop {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fwide(stream: *mut FILE, mode: c_int) -> c_int {
     (*stream).try_set_orientation(mode)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getwc(stream: *mut FILE) -> wint_t {
     fgetwc(stream)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn getwchar() -> wint_t {
     fgetwc(stdin)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mbsinit(ps: *const mbstate_t) -> c_int {
     //Add a check for the state maybe
-    if ps.is_null() {
-        1
-    } else {
-        0
-    }
+    if ps.is_null() { 1 } else { 0 }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mbrlen(s: *const c_char, n: size_t, ps: *mut mbstate_t) -> size_t {
     static mut INTERNAL: mbstate_t = mbstate_t;
-    mbrtowc(ptr::null_mut(), s, n, &mut INTERNAL)
+    mbrtowc(ptr::null_mut(), s, n, &raw mut INTERNAL)
 }
 
 //Only works for UTF8 at the moment
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mbrtowc(
     pwc: *mut wchar_t,
     s: *const c_char,
···
     static mut INTERNAL: mbstate_t = mbstate_t;
 
     if ps.is_null() {
-        let ps = &mut INTERNAL;
+        let ps = &raw mut INTERNAL;
     }
     if s.is_null() {
         let xs: [c_char; 1] = [0];
···
 
 //Convert a multibyte string to a wide string with a limited amount of bytes
 //Required for in POSIX.1-2008
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mbsnrtowcs(
     dst_ptr: *mut wchar_t,
     src_ptr: *mut *const c_char,
···
     static mut INTERNAL: mbstate_t = mbstate_t;
 
     if ps.is_null() {
-        let ps = &mut INTERNAL;
+        let ps = &raw mut INTERNAL;
     }
 
     let mut src = *src_ptr;
···
 }
 
 //Convert a multibyte string to a wide string
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn mbsrtowcs(
     dst: *mut wchar_t,
     src: *mut *const c_char,
···
     mbsnrtowcs(dst, src, size_t::max_value(), len, ps)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn putwc(wc: wchar_t, stream: *mut FILE) -> wint_t {
     fputwc(wc, &mut *stream)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn putwchar(wc: wchar_t) -> wint_t {
     fputwc(wc, &mut *stdout)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vswscanf(
     s: *const wchar_t,
     format: *const wchar_t,
···
     wscanf::scanf(reader, format, __valist)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn swscanf(
     s: *const wchar_t,
     format: *const wchar_t,
···
 }
 
 /// Push wide character `wc` back onto `stream` so it'll be read next
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn ungetwc(wc: wint_t, stream: &mut FILE) -> wint_t {
     if wc == WEOF {
         return wc;
···
     static mut INTERNAL: mbstate_t = mbstate_t;
     let mut bytes: [c_char; MB_CUR_MAX as usize] = [0; MB_CUR_MAX as usize];
 
-    let amount = wcrtomb(bytes.as_mut_ptr(), wc as wchar_t, &mut INTERNAL);
+    let amount = wcrtomb(bytes.as_mut_ptr(), wc as wchar_t, &raw mut INTERNAL);
     if amount == usize::MAX {
         return WEOF;
     }
···
     wc
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vfwprintf(
     stream: *mut FILE,
     format: *const wchar_t,
···
 
     wprintf::wprintf(&mut *stream, format, arg)
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn fwprintf(
     stream: *mut FILE,
     format: *const wchar_t,
···
     vfwprintf(stream, format, __valist.as_va_list())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vwprintf(format: *const wchar_t, arg: va_list) -> c_int {
     vfwprintf(&mut *stdout, format, arg)
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wprintf(format: *const wchar_t, mut __valist: ...) -> c_int {
     vfwprintf(&mut *stdout, format, __valist.as_va_list())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vswprintf(
     s: *mut wchar_t,
     n: size_t,
···
     eprintln!("vswprintf not implemented");
     -1
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn swprintf(
     s: *mut wchar_t,
     n: size_t,
···
     vswprintf(s, n, format, __valist.as_va_list())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcpcpy(d: *mut wchar_t, s: *const wchar_t) -> *mut wchar_t {
     return (wcscpy(d, s)).offset(wcslen(s) as isize);
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcpncpy(d: *mut wchar_t, s: *const wchar_t, n: size_t) -> *mut wchar_t {
     return (wcsncpy(d, s, n)).offset(wcsnlen(s, n) as isize);
 }
 
 //widechar to multibyte
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcrtomb(s: *mut c_char, wc: wchar_t, ps: *mut mbstate_t) -> size_t {
     let mut buffer: [c_char; MB_CUR_MAX as usize] = [0; MB_CUR_MAX as usize];
     let (s_cpy, wc_cpy) = if s.is_null() {
···
     utf8::wcrtomb(s_cpy, wc_cpy, ps)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcsdup(s: *const wchar_t) -> *mut wchar_t {
     let l = wcslen(s);
 
···
     wmemcpy(d, s, l + 1)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcsrtombs(
     s: *mut c_char,
     ws: *mut *const wchar_t,
···
     wcsnrtombs(s, ws, size_t::MAX, n, st)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcscat(ws1: *mut wchar_t, ws2: *const wchar_t) -> *mut wchar_t {
     wcsncat(ws1, ws2, usize::MAX)
 }
···
 /// The caller is required to ensure that `ws` is a valid pointer to a buffer
 /// containing at least one nul value. The pointed-to buffer must not be
 /// modified for the duration of the call.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcschr(ws: *const wchar_t, wc: wchar_t) -> *mut wchar_t {
     // We iterate over non-mut references and thus need to coerce the
     // resulting reference via a *const pointer before we can get our *mut.
···
     ptr.cast_mut()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcscmp(ws1: *const wchar_t, ws2: *const wchar_t) -> c_int {
     wcsncmp(ws1, ws2, usize::MAX)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcscoll(ws1: *const wchar_t, ws2: *const wchar_t) -> c_int {
     //TODO: locale comparison
     wcscmp(ws1, ws2)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcscpy(ws1: *mut wchar_t, ws2: *const wchar_t) -> *mut wchar_t {
     let mut i = 0;
     loop {
···
     count
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcscspn(wcs: *const wchar_t, set: *const wchar_t) -> size_t {
     inner_wcsspn(wcs, set, true)
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn wcsftime(
     wcs: *mut wchar_t,
     maxsize: size_t,
···
     unimplemented!();
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcslen(ws: *const wchar_t) -> size_t {
     unsafe { NulTerminated::new(ws).unwrap() }.count()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcsncat(
     ws1: *mut wchar_t,
     ws2: *const wchar_t,
···
     ws1
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcsncmp(ws1: *const wchar_t, ws2: *const wchar_t, n: size_t) -> c_int {
     for i in 0..n {
         let wc1 = *ws1.add(i);
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcsncpy(
     ws1: *mut wchar_t,
     ws2: *const wchar_t,
···
     ws1
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcsnlen(mut s: *const wchar_t, maxlen: size_t) -> size_t {
     let mut len = 0;
 
···
     return len;
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcsnrtombs(
     mut dest: *mut c_char,
     src: *mut *const wchar_t,
···
     written
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcspbrk(mut wcs: *const wchar_t, set: *const wchar_t) -> *mut wchar_t {
     wcs = wcs.add(wcscspn(wcs, set));
     if *wcs == 0 {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcsrchr(ws1: *const wchar_t, wc: wchar_t) -> *mut wchar_t {
     let mut last_matching_wc = 0 as *const wchar_t;
     let mut i = 0;
···
     last_matching_wc as *mut wchar_t
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcsspn(wcs: *const wchar_t, set: *const wchar_t) -> size_t {
     inner_wcsspn(wcs, set, false)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcsstr(ws1: *const wchar_t, ws2: *const wchar_t) -> *mut wchar_t {
     // Get length of ws2, not including null terminator
     let ws2_len = wcslen(ws2);
···
     };
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcstod(mut ptr: *const wchar_t, end: *mut *mut wchar_t) -> c_double {
     const RADIX: u32 = 10;
 
···
     result
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcstok(
     mut wcs: *mut wchar_t,
     delim: *const wchar_t,
···
     }};
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcstol(
     mut ptr: *const wchar_t,
     end: *mut *mut wchar_t,
···
     result
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcstoll(
     mut ptr: *const wchar_t,
     end: *mut *mut wchar_t,
···
     result
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcstoimax(
     mut ptr: *const wchar_t,
     end: *mut *mut wchar_t,
···
     result
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcstoul(
     mut ptr: *const wchar_t,
     end: *mut *mut wchar_t,
···
     result
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcstoull(
     mut ptr: *const wchar_t,
     end: *mut *mut wchar_t,
···
     result
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcstoumax(
     mut ptr: *const wchar_t,
     end: *mut *mut wchar_t,
···
     result
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcswcs(ws1: *const wchar_t, ws2: *const wchar_t) -> *mut wchar_t {
     wcsstr(ws1, ws2)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wcswidth(pwcs: *const wchar_t, n: size_t) -> c_int {
     let mut total_width = 0;
     for i in 0..n {
···
     total_width
 }
 
-// #[no_mangle]
+// #[unsafe(no_mangle)]
 pub extern "C" fn wcsxfrm(ws1: *mut wchar_t, ws2: *const wchar_t, n: size_t) -> size_t {
     unimplemented!();
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn wctob(c: wint_t) -> c_int {
-    if c <= 0x7F {
-        c as c_int
-    } else {
-        EOF
-    }
+    if c <= 0x7F { c as c_int } else { EOF }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn wcwidth(wc: wchar_t) -> c_int {
     match char::from_u32(wc as u32) {
         Some(c) => match unicode_width::UnicodeWidthChar::width(c) {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wmemchr(ws: *const wchar_t, wc: wchar_t, n: size_t) -> *mut wchar_t {
     for i in 0..n {
         if *ws.add(i) == wc {
···
     ptr::null_mut()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wmemcmp(ws1: *const wchar_t, ws2: *const wchar_t, n: size_t) -> c_int {
     for i in 0..n {
         let wc1 = *ws1.add(i);
···
     0
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wmemcpy(
     ws1: *mut wchar_t,
     ws2: *const wchar_t,
···
     ) as *mut wchar_t
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wmemmove(
     ws1: *mut wchar_t,
     ws2: *const wchar_t,
···
     ) as *mut wchar_t
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wmemset(ws: *mut wchar_t, wc: wchar_t, n: size_t) -> *mut wchar_t {
     for i in 0..n {
         *ws.add(i) = wc;
···
     ws
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn vwscanf(format: *const wchar_t, __valist: va_list) -> c_int {
     let mut file = (*stdin).lock();
     if let Err(_) = file.try_set_byte_orientation_unlocked() {
···
     wscanf::scanf(reader, format, __valist)
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wscanf(format: *const wchar_t, mut __valist: ...) -> c_int {
     vwscanf(format, __valist.as_va_list())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn wcscasecmp(mut s1: *const wchar_t, mut s2: *const wchar_t) -> c_int {
     unsafe {
         while *s1 != 0 && *s2 != 0 {
···
     }
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn wcsncasecmp(mut s1: *const wchar_t, mut s2: *const wchar_t, n: size_t) -> c_int {
     if n == 0 {
         return 0;

src/header/wchar/utf8.rs

···
         *pwc = result;
     }
 
-    if result != 0 {
-        size
-    } else {
-        0
-    }
+    if result != 0 { size } else { 0 }
 }
 
 //It's guaranteed that we don't have any nullpointers here

src/header/wchar/wprintf.rs

···
 
             (FmtKind::Char, _)
             | (FmtKind::Unsigned, IntKind::Byte)
-            | (FmtKind::Signed, IntKind::Byte) => VaArg::c_char(ap.arg::<c_char>()),
+            | (FmtKind::Signed, IntKind::Byte) => {
+                // c_int is passed but truncated to c_char
+                VaArg::c_char(ap.arg::<c_int>() as c_char)
+            }
             (FmtKind::Unsigned, IntKind::Short) | (FmtKind::Signed, IntKind::Short) => {
-                VaArg::c_short(ap.arg::<c_short>())
+                // c_int is passed but truncated to c_short
+                VaArg::c_short(ap.arg::<c_int>() as c_short)
             }
             (FmtKind::Unsigned, IntKind::Int) | (FmtKind::Signed, IntKind::Int) => {
                 VaArg::c_int(ap.arg::<c_int>())

src/header/wchar/wscanf.rs

···
 unsafe fn next_char(string: &mut *const wchar_t) -> Result<wint_t, c_int> {
     let c = **string as wint_t;
     *string = string.offset(1);
-    if c == 0 {
-        Err(-1)
-    } else {
-        Ok(c)
-    }
+    if c == 0 { Err(-1) } else { Ok(c) }
 }
 
 macro_rules! wc_as_char {

src/header/wctype/mod.rs

···
 const WCTRANSLW: wctrans_t = 2 as wctrans_t;
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswalnum.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswalnum(wc: wint_t) -> c_int {
     c_int::from(iswdigit(wc) != 0 || iswalpha(wc) != 0)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswalpha.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswalpha(wc: wint_t) -> c_int {
     c_int::from(alpha::is(wc as usize))
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswblank.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswblank(wc: wint_t) -> c_int {
     ctype::isblank(wc as c_int)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswcntrl.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswcntrl(wc: wint_t) -> c_int {
     c_int::from(
         wc < 32
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswctype.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswctype(wc: wint_t, desc: wctype_t) -> c_int {
     match desc {
         WCTYPE_ALNUM => iswalnum(wc),
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswdigit.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswdigit(wc: wint_t) -> c_int {
     c_int::from(wc.wrapping_sub('0' as wint_t) < 10)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswgraph.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswgraph(wc: wint_t) -> c_int {
     c_int::from(iswspace(wc) == 0 && iswprint(wc) != 0)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswlower.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswlower(wc: wint_t) -> c_int {
     c_int::from(towupper(wc) != wc)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswprint.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswprint(wc: wint_t) -> c_int {
     if wc < 0xff {
         c_int::from((wc + 1 & 0x7f) >= 0x21)
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswpunct.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswpunct(wc: wint_t) -> c_int {
     c_int::from(punct::is(wc as usize))
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswspace.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswspace(wc: wint_t) -> c_int {
     c_int::from(
         [
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswupper.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswupper(wc: wint_t) -> c_int {
     c_int::from(towlower(wc) != wc)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/iswxdigit.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn iswxdigit(wc: wint_t) -> c_int {
     c_int::from(wc.wrapping_sub('0' as wint_t) < 10 || (wc | 32).wrapping_sub('a' as wint_t) < 6)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/towctrans.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn towctrans(wc: wint_t, trans: wctrans_t) -> wint_t {
     match trans {
         WCTRANSUP => towupper(wc),
···
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/towlower.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn towlower(wc: wint_t) -> wint_t {
     casemap(wc, 0)
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/towupper.html>.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn towupper(wc: wint_t) -> wint_t {
     casemap(wc, 1)
 }
···
 /// # Safety
 /// The caller must ensure that `class` is convertible to a slice reference, up
 /// to and including a terminating nul.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wctrans(class: *const c_char) -> wctrans_t {
     let class_cstr = unsafe { CStr::from_ptr(class) };
     match class_cstr.to_bytes() {
···
 /// # Safety
 /// The caller must ensure that `name` is convertible to a slice reference, up
 /// to and including a terminating nul.
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn wctype(name: *const c_char) -> wctype_t {
     let name_cstr = unsafe { CStr::from_ptr(name) };
     match name_cstr.to_bytes() {

src/io/buffered.rs

···
 use core::{cmp, fmt};
 
 use crate::io::{
-    self, prelude::*, Error, ErrorKind, Initializer, SeekFrom, Write, DEFAULT_BUF_SIZE,
+    self, DEFAULT_BUF_SIZE, Error, ErrorKind, Initializer, SeekFrom, Write, prelude::*,
 };
 
 /// The `BufReader` struct adds buffering to any reader.
···
 mod tests {
     use alloc::string::String;
 
-    use crate::io::{self, prelude::*, BufReader, BufWriter, LineWriter, SeekFrom};
+    use crate::io::{self, BufReader, BufWriter, LineWriter, SeekFrom, prelude::*};
     use test;
     // use crate::sync::atomic::{AtomicUsize, Ordering};
 

src/io/cursor.rs

···
 
 use core::cmp;
 
-use crate::io::{self, prelude::*, Error, ErrorKind, Initializer, SeekFrom};
+use crate::io::{self, Error, ErrorKind, Initializer, SeekFrom, prelude::*};
 
 /// A `Cursor` wraps an in-memory buffer and provides it with a
 /// [`Seek`] implementation.
···
 
 #[cfg(test)]
 mod tests {
-    use crate::io::{prelude::*, Cursor, SeekFrom};
+    use crate::io::{Cursor, SeekFrom, prelude::*};
 
     #[test]
     fn test_vec_writer() {

src/io/impls.rs

···
 use alloc::string::String;
 use core::{cmp, fmt, mem};
 
-use crate::io::{self, prelude::*, Error, ErrorKind, Initializer, Seek, SeekFrom, Write};
+use crate::io::{self, Error, ErrorKind, Initializer, Seek, SeekFrom, Write, prelude::*};
 
 impl<'a, R: Read + ?Sized> Read for &'a mut R {
     #[inline]

src/io/mod.rs

···
                     return Err(Error::new(
                         ErrorKind::WriteZero,
                         "failed to write whole buffer",
-                    ))
+                    ));
                 }
                 Ok(n) => buf = &buf[n..],
                 Err(ref e) if e.kind() == ErrorKind::Interrupted => {}

src/ld_so/access.rs

···
 use crate::{
     c_str::{CStr, CString},
     error::Errno,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 
 pub fn accessible(path: &str, mode: c_int) -> Result<(), Errno> {

src/ld_so/debug.rs

···
  * break point there
  */
 #[linkage = "weak"]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn _dl_debug_state() {}
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub static _r_debug: spin::Mutex<RTLDDebug> = spin::Mutex::new(RTLDDebug::NEW);

src/ld_so/dso.rs

···
 //! * <https://www.akkadia.org/drepper/dsohowto.pdf>
 
 use object::{
-    elf,
+    NativeEndian, Object, StringTable, SymbolIndex, elf,
     read::elf::{
         Dyn as _, GnuHashTable, HashTable as SysVHashTable, ProgramHeader as _, Rel as _,
         Rela as _, Sym as _, Version, VersionTable,
     },
-    NativeEndian, Object, StringTable, SymbolIndex,
 };
 
 use super::{
-    debug::{RTLDDebug, _r_debug},
-    linker::{Resolve, Scope, Symbol, __plt_resolve_trampoline, GLOBAL_SCOPE},
+    debug::{_r_debug, RTLDDebug},
+    linker::{__plt_resolve_trampoline, GLOBAL_SCOPE, Resolve, Scope, Symbol},
     tcb::Master,
 };
 use crate::{
     header::sys_mman,
-    platform::{types::c_void, Pal, Sys},
+    platform::{Pal, Sys, types::c_void},
 };
 use alloc::{
     string::{String, ToString},
···
 
 #[cfg(target_pointer_width = "32")]
 mod shim {
-    use object::{elf::*, read::elf::ElfFile32, NativeEndian};
+    use object::{NativeEndian, elf::*, read::elf::ElfFile32};
     pub type Dyn = Dyn32<NativeEndian>;
     pub type Rel = Rel32<NativeEndian>;
     pub type Rela = Rela32<NativeEndian>;
···
 
 #[cfg(target_pointer_width = "64")]
 mod shim {
-    use object::{elf::*, read::elf::ElfFile64, NativeEndian};
+    use object::{NativeEndian, elf::*, read::elf::ElfFile64};
     pub type Dyn = Dyn64<NativeEndian>;
     pub type Rel = Rel64<NativeEndian>;
     pub type Rela = Rela64<NativeEndian>;

src/ld_so/linker.rs

···
     vec::Vec,
 };
 use object::{
-    elf,
+    NativeEndian, elf,
     read::elf::{Rela as _, Sym},
-    NativeEndian,
 };
 
 use core::{
···
         fcntl, sys_mman,
         unistd::F_OK,
     },
-    ld_so::dso::{resolve_sym, SymbolBinding},
+    ld_so::dso::{SymbolBinding, resolve_sym},
     out::Out,
     platform::{
-        types::{c_int, c_uint, c_void},
         Pal, Sys,
+        types::{c_int, c_uint, c_void},
     },
     sync::rwlock::RwLock,
 };
 
 use super::{
+    PATH_SEP,
     access::accessible,
     callbacks::LinkerCallbacks,
-    debug::{RTLDState, _dl_debug_state, _r_debug},
-    dso::{ProgramHeader, Rela, DSO},
+    debug::{_dl_debug_state, _r_debug, RTLDState},
+    dso::{DSO, ProgramHeader, Rela},
     tcb::{Master, Tcb},
-    PATH_SEP,
 };
 
 #[derive(Debug, Copy, Clone)]
···
     fn set_owner(&mut self, obj: Weak<DSO>) {
         match self {
             Self::Global { .. } => panic!("attempted to set global scope owner"),
-            Self::Local { ref mut owner, .. } => {
+            Self::Local { owner, .. } => {
                 assert!(owner.is_none(), "attempted to change local scope owner");
                 *owner = Some(obj);
             }
···
     ) -> Result<ObjectHandle> {
         trace!(
             "[ld.so] load_library(name={:?}, resolve={:#?}, scope={:#?}, noload={})",
-            name,
-            resolve,
-            scope,
-            noload
+            name, resolve, scope, noload
         );
 
         if noload && resolve == Resolve::Now {
···
     resolved
 }
 
-extern "C" {
+unsafe extern "C" {
     pub(super) fn __plt_resolve_trampoline() -> usize;
 }
 

src/ld_so/mod.rs

···
 
 use core::{mem, ptr};
 use object::{
+    Endianness,
     elf::{self, ProgramHeader32, ProgramHeader64},
     read::elf::ProgramHeader,
-    Endianness,
 };
 
 use self::tcb::{Master, Tcb};
···
 pub mod start;
 pub mod tcb;
 
-pub use generic_rt::{panic_notls, ExpectTlsFree};
+pub use generic_rt::{ExpectTlsFree, panic_notls};
 
 static mut STATIC_TCB_MASTER: Master = Master {
     ptr: ptr::null_mut(),

src/ld_so/start.rs

···
 use generic_rt::ExpectTlsFree;
 
 use crate::{
+    ALLOCATOR,
     c_str::CStr,
     header::unistd,
     platform::{get_auxv, get_auxvs, types::c_char},
     start::Stack,
     sync::mutex::Mutex,
-    ALLOCATOR,
 };
 
 use super::{
+    PATH_SEP,
     access::accessible,
     debug::_r_debug,
     linker::{Config, Linker},
     tcb::Tcb,
-    PATH_SEP,
 };
 use crate::header::sys_auxv::{AT_ENTRY, AT_PHDR};
 
···
     None
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn relibc_ld_so_start(sp: &'static mut Stack, ld_entry: usize) -> usize {
     // Setup TCB for ourselves.
     unsafe {
···
     };
 
     unsafe {
-        crate::platform::OUR_ENVIRON = envs
+        *crate::platform::OUR_ENVIRON.as_mut_ptr() = envs
             .iter()
             .map(|(k, v)| {
                 let mut var = Vec::with_capacity(k.len() + v.len() + 2);
···
             .chain(core::iter::once(core::ptr::null_mut()))
             .collect::<Vec<_>>();
 
-        crate::platform::environ = crate::platform::OUR_ENVIRON.as_mut_ptr();
+        crate::platform::environ = crate::platform::OUR_ENVIRON.unsafe_mut().as_mut_ptr();
     }
 
     let is_manual = if let Some(img_entry) = get_auxv(&auxv, AT_ENTRY) {

src/lib.rs

···
 pub mod start;
 pub mod sync;
 
-use crate::platform::{Allocator, Pal, Sys, NEWALLOCATOR};
+use crate::platform::{Allocator, NEWALLOCATOR, Pal, Sys};
 
 #[global_allocator]
 static ALLOCATOR: Allocator = NEWALLOCATOR;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn relibc_panic(pi: &::core::panic::PanicInfo) -> ! {
     use core::fmt::Write;
 
···
 #[cfg(not(test))]
 #[panic_handler]
 #[linkage = "weak"]
-#[no_mangle]
 pub fn rust_begin_unwind(pi: &::core::panic::PanicInfo) -> ! {
     relibc_panic(pi)
 }
 
 #[cfg(not(test))]
 #[lang = "eh_personality"]
-#[no_mangle]
 #[linkage = "weak"]
 pub extern "C" fn rust_eh_personality() {}
 
 #[cfg(not(test))]
 #[alloc_error_handler]
 #[linkage = "weak"]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn rust_oom(layout: ::core::alloc::Layout) -> ! {
     use core::fmt::Write;
 
···
 #[cfg(not(test))]
 #[allow(non_snake_case)]
 #[linkage = "weak"]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn _Unwind_Resume() -> ! {
     use core::fmt::Write;
 

src/macros.rs

···
         let num = if overflow {
             platform::ERRNO.set(ERANGE);
             if CHECK_SIGN {
-                if positive {
-                    MAX_VAL
-                } else {
-                    MIN_VAL
-                }
+                if positive { MAX_VAL } else { MIN_VAL }
             } else {
                 MAX_VAL
             }

src/platform/allocator/mod.rs

···
 
 mod sys;
 use super::types::*;
-use crate::{sync::Mutex, ALLOCATOR};
+use crate::{ALLOCATOR, sync::Mutex};
 use dlmalloc::DlmallocCApi;
 
 pub type Dlmalloc = DlmallocCApi<sys::System>;

src/platform/allocator/sys.rs

···
         sys_mman::{self, MAP_FAILED, MREMAP_MAYMOVE},
         unistd::pthread_atfork,
     },
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
     sync::Mutex,
 };
 use core::ptr;

src/platform/linux/epoll.rs

···
-use super::{e_raw, Sys};
+use super::{Sys, e_raw};
 use crate::{
     error::Result,
     header::{signal::sigset_t, sys_epoll::epoll_event},
-    platform::{types::*, PalEpoll},
+    platform::{PalEpoll, types::*},
 };
 
 impl PalEpoll for Sys {

src/platform/linux/mod.rs

···
 use core::{arch::asm, ptr};
 
-use super::{types::*, Pal, ERRNO};
+use super::{ERRNO, Pal, types::*};
 use crate::{
     c_str::CStr,
     header::{
···
         fcntl::{AT_EMPTY_PATH, AT_FDCWD, AT_REMOVEDIR, AT_SYMLINK_NOFOLLOW},
         signal::SIGCHLD,
         sys_resource::{rlimit, rusage},
-        sys_stat::{stat, S_IFIFO},
+        sys_stat::{S_IFIFO, stat},
         sys_statvfs::statvfs,
         sys_time::{timeval, timezone},
         unistd::{SEEK_CUR, SEEK_SET},

src/platform/linux/ptrace.rs

···
 use super::{
-    super::{types::*, PalPtrace},
-    e_raw, Sys,
+    super::{PalPtrace, types::*},
+    Sys, e_raw,
 };
 use crate::error::Result;
 

src/platform/linux/signal.rs

···
 use core::{mem, ptr::addr_of};
 
 use super::{
-    super::{types::*, PalSignal},
-    e_raw, Sys,
+    super::{PalSignal, types::*},
+    Sys, e_raw,
 };
 use crate::{
     error::{Errno, Result},
     header::{
-        signal::{sigaction, siginfo_t, sigset_t, stack_t, NSIG, SA_RESTORER, SI_QUEUE},
+        signal::{NSIG, SA_RESTORER, SI_QUEUE, sigaction, siginfo_t, sigset_t, stack_t},
         sys_time::itimerval,
         time::timespec,
     },
···
         act: Option<&sigaction>,
         oact: Option<&mut sigaction>,
     ) -> Result<(), Errno> {
-        extern "C" {
+        unsafe extern "C" {
             fn __restore_rt();
         }
         let act = act.map(|act| {

src/platform/linux/socket.rs

···
-use super::{e_raw, Sys};
+use super::{Sys, e_raw};
 use crate::{
     error::Result,
     header::sys_socket::{msghdr, sockaddr, socklen_t},
-    platform::{types::*, PalSocket},
+    platform::{PalSocket, types::*},
 };
 
 impl PalSocket for Sys {

src/platform/mod.rs

···
 use crate::{
     error::{Errno, ResultExt},
     io::{self, Read, Write},
+    raw_cell::RawCell,
 };
 use alloc::{boxed::Box, vec::Vec};
 use core::{cell::Cell, fmt, ptr};
···
 #[allow(non_upper_case_globals)]
 pub static mut argv: *mut *mut c_char = ptr::null_mut();
 #[allow(non_upper_case_globals)]
-pub static mut inner_argv: Vec<*mut c_char> = Vec::new();
+pub static inner_argv: RawCell<Vec<*mut c_char>> = RawCell::new(Vec::new());
 #[allow(non_upper_case_globals)]
 pub static mut program_invocation_name: *mut c_char = ptr::null_mut();
 #[allow(non_upper_case_globals)]
 pub static mut program_invocation_short_name: *mut c_char = ptr::null_mut();
 
 #[allow(non_upper_case_globals)]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub static mut environ: *mut *mut c_char = ptr::null_mut();
 
-pub static mut OUR_ENVIRON: Vec<*mut c_char> = Vec::new();
+pub static OUR_ENVIRON: RawCell<Vec<*mut c_char>> = RawCell::new(Vec::new());
 
 pub fn environ_iter() -> impl Iterator<Item = *mut c_char> + 'static {
     unsafe {

src/platform/pal/epoll.rs

···
 use crate::{
     error::{Errno, Result},
     header::{signal::sigset_t, sys_epoll::epoll_event},
-    platform::{types::*, Pal},
+    platform::{Pal, types::*},
 };
 
 pub trait PalEpoll: Pal {

src/platform/pal/ptrace.rs

···
 use crate::{
     error::Result,
-    platform::{types::*, Pal},
+    platform::{Pal, types::*},
 };
 
 pub trait PalPtrace: Pal {

src/platform/pal/signal.rs

···
-use super::super::{types::*, Pal};
+use super::super::{Pal, types::*};
 use crate::{
     error::{Errno, Result},
     header::{

src/platform/pal/socket.rs

···
 use crate::{
     error::Result,
     header::sys_socket::{msghdr, sockaddr, socklen_t},
-    platform::{types::*, Pal},
+    platform::{Pal, types::*},
 };
 
 pub trait PalSocket: Pal {

src/platform/redox/clone.rs

···
 use core::mem::size_of;
 
 use syscall::{
+    SetSighandlerData,
     data::Map,
     error::Result,
     flag::{MapFlags, O_CLOEXEC},
-    SetSighandlerData,
 };
 
 use redox_rt::{proc::FdGuard, signal::sighandler_function};

src/platform/redox/epoll.rs

···
 use super::{
-    super::{types::*, Pal, PalEpoll},
+    super::{Pal, PalEpoll, types::*},
     Sys,
 };
 

src/platform/redox/event.rs

···
 use super::libredox::RawResult;
 
 use bitflags::Flags;
-use syscall::{Error, Result, EINVAL};
+use syscall::{EINVAL, Error, Result};
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_event_queue_create_v1(flags: u32) -> RawResult {
     Error::mux((|| {
         if flags != 0 {
···
         Ok(super::libredox::open("/scheme/event", O_CLOEXEC | O_CREAT | O_RDWR, 0o700)? as usize)
     })())
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_event_queue_get_events_v1(
     queue: usize,
     buf: *mut event::raw::RawEventV1,
···
         Ok(1)
     })())
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_event_queue_ctl_v1(
     queue: usize,
     fd: usize,
···
         Ok(0)
     })())
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_event_queue_destroy_v1(queue: usize) -> RawResult {
     Error::mux(syscall::close(queue))
 }

src/platform/redox/exec.rs

···
     c_str::{CStr, CString},
     fs::File,
     header::{limits::PATH_MAX, string::strlen},
-    io::{prelude::*, BufReader, SeekFrom},
+    io::{BufReader, SeekFrom, prelude::*},
     platform::{
         sys::{S_ISGID, S_ISUID},
         types::*,
···
 };
 
 use redox_rt::{
+    RtTcb,
     proc::{ExtraInfo, FdGuard, FexecResult, InterpOverride},
     sys::Resugid,
-    RtTcb,
 };
 use syscall::{data::Stat, error::*, flag::*};
 

src/platform/redox/extra.rs

···
     error::{Errno, ResultExt},
     platform::types::*,
 };
-use syscall::{error::*, F_SETFD, F_SETFL};
+use syscall::{F_SETFD, F_SETFL, error::*};
 
 pub use redox_rt::proc::FdGuard;
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fpath(fd: c_int, buf: *mut c_void, count: size_t) -> ssize_t {
     syscall::fpath(
         fd as usize,

src/platform/redox/libcscheme.rs

···
 use super::libredox;
 use crate::{c_str::CStr, header::stdlib::getenv, platform::types::*};
 use core::{ptr, slice};
-use syscall::{flag::*, Error, Result, EINVAL, EIO, ENOENT};
+use syscall::{EINVAL, EIO, ENOENT, Error, Result, flag::*};
 
 pub const LIBC_SCHEME: &'static str = "libc:";
 

src/platform/redox/libredox.rs

···
 
 use redox_rt::{
     protocol::{ProcKillTarget, SocketCall, WaitFlags},
-    sys::{posix_read, posix_write, WaitpidTarget},
+    sys::{WaitpidTarget, posix_read, posix_write},
 };
-use syscall::{Error, Result, EMFILE};
+use syscall::{EMFILE, Error, Result};
 
 use crate::{
     header::{
         errno::EINVAL,
-        signal::{sigaction, SIG_BLOCK, SIG_SETMASK, SIG_UNBLOCK},
+        signal::{SIG_BLOCK, SIG_SETMASK, SIG_UNBLOCK, sigaction},
         sys_stat::UTIME_NOW,
         sys_uio::iovec,
         time::timespec,
     },
     out::Out,
-    platform::{types::*, PalSignal},
+    platform::{PalSignal, types::*},
 };
 
 use super::Sys;
···
     Ok(())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_open_v1(
     path_base: *const u8,
     path_len: usize,
···
         mode as mode_t,
     ))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_openat_v1(
     fd: usize,
     path_base: *const u8,
···
         flags as usize,
     ))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_dup_v1(fd: usize, buf: *const u8, len: usize) -> RawResult {
     Error::mux(syscall::dup(fd, core::slice::from_raw_parts(buf, len)))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_dup2_v1(
     old_fd: usize,
     new_fd: usize,
···
         core::slice::from_raw_parts(buf, len),
     ))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_read_v1(fd: usize, dst_base: *mut u8, dst_len: usize) -> RawResult {
     Error::mux(posix_read(fd, slice::from_raw_parts_mut(dst_base, dst_len)))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_write_v1(
     fd: usize,
     src_base: *const u8,
···
 ) -> RawResult {
     Error::mux(posix_write(fd, slice::from_raw_parts(src_base, src_len)))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fsync_v1(fd: usize) -> RawResult {
     Error::mux(syscall::fsync(fd))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fdatasync_v1(fd: usize) -> RawResult {
     // TODO
     Error::mux(syscall::fsync(fd))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fchmod_v1(fd: usize, new_mode: u16) -> RawResult {
     Error::mux(syscall::fchmod(fd, new_mode))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fchown_v1(fd: usize, new_uid: u32, new_gid: u32) -> RawResult {
     Error::mux(syscall::fchown(fd, new_uid, new_gid))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fpath_v1(fd: usize, dst_base: *mut u8, dst_len: usize) -> RawResult {
     Error::mux(syscall::fpath(
         fd,
         core::slice::from_raw_parts_mut(dst_base, dst_len),
     ))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fstat_v1(
     fd: usize,
     stat: *mut crate::header::sys_stat::stat,
 ) -> RawResult {
     Error::mux(fstat(fd, stat).map(|()| 0))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fstatvfs_v1(
     fd: usize,
     stat: *mut crate::header::sys_statvfs::statvfs,
 ) -> RawResult {
     Error::mux(fstatvfs(fd, stat).map(|()| 0))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_futimens_v1(fd: usize, times: *const timespec) -> RawResult {
     Error::mux(futimens(fd, times).map(|()| 0))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_close_v1(fd: usize) -> RawResult {
     Error::mux(syscall::close(fd))
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_get_pid_v1() -> RawResult {
     redox_rt::sys::posix_getpid() as _
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_get_euid_v1() -> RawResult {
     redox_rt::sys::posix_getresugid().euid as _
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_get_ruid_v1() -> RawResult {
     redox_rt::sys::posix_getresugid().ruid as _
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_get_egid_v1() -> RawResult {
     redox_rt::sys::posix_getresugid().egid as _
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_get_rgid_v1() -> RawResult {
     redox_rt::sys::posix_getresugid().rgid as _
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_get_ens_v0() -> RawResult {
     Error::mux(redox_rt::sys::getens())
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_get_proc_credentials_v1(
     cap_fd: usize,
     target_pid: usize,
···
     Error::mux(redox_rt::sys::get_proc_credentials(cap_fd, target_pid, buf))
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_setrens_v1(rns: usize, ens: usize) -> RawResult {
     Error::mux(redox_rt::sys::setrens(rns, ens).map(|()| 0))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_waitpid_v1(pid: usize, status: *mut i32, options: u32) -> RawResult {
     let mut sts = 0_usize;
     let res = Error::mux(redox_rt::sys::sys_waitpid(
···
     res
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_kill_v1(pid: usize, signal: u32) -> RawResult {
     Error::mux(
         redox_rt::sys::posix_kill(ProcKillTarget::from_raw(pid), signal as usize).map(|()| 0),
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_sigaction_v1(
     signal: u32,
     new: *const sigaction,
···
     )
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_sigprocmask_v1(
     how: u32,
     new: *const u64,
···
             .map_err(Into::into),
     )
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_mmap_v1(
     addr: *mut (),
     unaligned_len: usize,
···
         },
     ))
 }
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_munmap_v1(addr: *mut (), unaligned_len: usize) -> RawResult {
     Error::mux(syscall::funmap(addr as usize, unaligned_len))
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_clock_gettime_v1(clock: usize, ts: *mut timespec) -> RawResult {
     Error::mux(clock_gettime(clock, Out::nonnull(ts)).map(|()| 0))
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_strerror_v1(
     buf: *mut u8,
     buflen: *mut usize,
···
     })())
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_mkns_v1(
     names: *const iovec,
     num_names: usize,
···
 }
 
 // ABI-UNSTABLE
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_cur_procfd_v0() -> usize {
     **redox_rt::current_proc_fd()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_cur_thrfd_v0() -> usize {
     **redox_rt::RtTcb::current().thread_fd()
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_sys_call_v0(
     fd: usize,
     payload: *mut u8,
···
     ))
 }
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_get_socket_token_v0(
     fd: usize,
     payload: *mut u8,

src/platform/redox/mod.rs

···
     ptr, slice, str,
 };
 use redox_rt::{
-    protocol::{wifstopped, wstopsig, WaitFlags},
-    sys::{Resugid, WaitpidTarget},
     RtTcb,
+    protocol::{WaitFlags, wifstopped, wstopsig},
+    sys::{Resugid, WaitpidTarget},
 };
 use syscall::{
-    self,
+    self, EMFILE, Error, MODE_PERM, PtraceEvent,
     data::{Map, Stat as redox_stat, StatVfs as redox_statvfs, TimeSpec as redox_timespec},
     dirent::{DirentHeader, DirentKind},
-    Error, PtraceEvent, EMFILE, MODE_PERM,
 };
 
 use crate::{
···
         limits,
         sys_mman::{MAP_ANONYMOUS, MAP_FAILED, PROT_READ, PROT_WRITE},
         sys_random,
-        sys_resource::{rlimit, rusage, RLIM_INFINITY},
-        sys_stat::{stat, S_ISGID, S_ISUID, S_ISVTX},
+        sys_resource::{RLIM_INFINITY, rlimit, rusage},
+        sys_stat::{S_ISGID, S_ISUID, S_ISVTX, stat},
         sys_statvfs::statvfs,
         sys_time::{timeval, timezone},
-        sys_utsname::{utsname, UTSLENGTH},
+        sys_utsname::{UTSLENGTH, utsname},
         sys_wait,
         time::timespec,
         unistd::{F_OK, R_OK, SEEK_CUR, SEEK_SET, W_OK, X_OK},
     },
-    io::{self, prelude::*, BufReader},
+    io::{self, BufReader, prelude::*},
     out::Out,
     sync::rwlock::RwLock,
 };
 
 pub use redox_rt::proc::FdGuard;
 
-use super::{types::*, Pal, Read, ERRNO};
+use super::{ERRNO, Pal, Read, types::*};
 
 static mut BRK_CUR: *mut c_void = ptr::null_mut();
 static mut BRK_END: *mut c_void = ptr::null_mut();
···
         // normal: We still need to add WUNTRACED, but we only return
         // it if (and only if) a ptrace traceme was activated during
         // the wait.
-        let res = res.unwrap_or_else(|| loop {
-            let res = inner(&mut status, options | WaitFlags::WUNTRACED);
+        let res = res.unwrap_or_else(|| {
+            loop {
+                let res = inner(&mut status, options | WaitFlags::WUNTRACED);
 
-            // TODO: Also handle special PIDs here
-            if !wifstopped(status)
-                || options.contains(WaitFlags::WUNTRACED)
-                || ptrace::is_traceme(pid)
-            {
-                break res;
+                // TODO: Also handle special PIDs here
+                if !wifstopped(status)
+                    || options.contains(WaitFlags::WUNTRACED)
+                    || ptrace::is_traceme(pid)
+                {
+                    break res;
+                }
             }
         });
 

src/platform/redox/path.rs

···
 use redox_rt::signal::tmp_disable_signals;
 use syscall::{data::Stat, error::*, flag::*};
 
-use super::{libcscheme, FdGuard, Pal, Sys};
+use super::{FdGuard, Pal, Sys, libcscheme};
 use crate::{
     error::Errno,
     fs::File,
···
     sync::Mutex,
 };
 
-pub use redox_path::{canonicalize_using_cwd, RedoxPath};
+pub use redox_path::{RedoxPath, canonicalize_using_cwd};
 
 // TODO: Define in syscall
 const PATH_MAX: usize = 4096;

src/platform/redox/ptrace.rs

···
 //! we are NOT going to bend our API for the sake of
 //! compatibility. So, this module will be a hellhole.
 
-use super::super::{types::*, Pal, PalPtrace, PalSignal, Sys, ERRNO};
+use super::super::{ERRNO, Pal, PalPtrace, PalSignal, Sys, types::*};
 #[cfg(target_arch = "aarch64")]
 use crate::header::arch_aarch64_user::user_regs_struct;
 #[cfg(target_arch = "x86_64")]
···
         fcntl, signal, sys_ptrace,
     },
     io::{self, prelude::*},
+    raw_cell::RawCell,
     sync::Mutex,
 };
 
-use alloc::collections::{btree_map::Entry, BTreeMap};
+use alloc::collections::{BTreeMap, btree_map::Entry};
 use core::mem;
 use syscall;
 
···
 }
 
 #[thread_local]
-static mut STATE: Option<State> = None;
+static STATE: RawCell<Option<State>> = RawCell::new(None);
 
 pub fn init_state() -> &'static State {
-    // Safe due to STATE being thread_local
+    // Safe due to STATE being thread_local (TODO: is it though?)
     unsafe {
-        if STATE.is_none() {
-            STATE = Some(State::new())
+        if STATE.unsafe_ref().is_none() {
+            *STATE.as_mut_ptr() = Some(State::new())
         }
-        STATE.as_ref().unwrap()
+        let state_ptr = STATE.unsafe_ref().as_ref().unwrap() as *const State;
+        &*state_ptr
     }
 }
 pub fn is_traceme(pid: pid_t) -> bool {

src/platform/redox/signal.rs

···
 use super::{
-    super::{types::*, Pal, PalSignal},
+    super::{Pal, PalSignal, types::*},
     Sys,
 };
 use crate::{
···
     header::{
         errno::{EINVAL, ENOSYS},
         signal::{
-            sigaction, siginfo_t, sigset_t, sigval, stack_t, ucontext_t, NSIG, SA_SIGINFO,
-            SIGRTMIN, SIG_BLOCK, SIG_DFL, SIG_IGN, SIG_SETMASK, SIG_UNBLOCK, SS_DISABLE,
-            SS_ONSTACK,
+            NSIG, SA_SIGINFO, SIG_BLOCK, SIG_DFL, SIG_IGN, SIG_SETMASK, SIG_UNBLOCK, SIGRTMIN,
+            SS_DISABLE, SS_ONSTACK, sigaction, siginfo_t, sigset_t, sigval, stack_t, ucontext_t,
         },
-        sys_time::{itimerval, ITIMER_REAL},
+        sys_time::{ITIMER_REAL, itimerval},
         time::timespec,
     },
     platform::ERRNO,

src/platform/redox/socket.rs

···
 use syscall::{self, flag::*};
 
 use super::{
-    super::{types::*, Pal, PalSocket, ERRNO},
-    path::dir_path_and_fd_path,
+    super::{ERRNO, Pal, PalSocket, types::*},
     Sys,
+    path::dir_path_and_fd_path,
 };
 use crate::{
     error::{Errno, Result, ResultExt},
···
         netinet_in::{in_addr, in_port_t, sockaddr_in},
         string::strnlen,
         sys_socket::{
-            cmsghdr, constants::*, msghdr, sa_family_t, sockaddr, socklen_t, ucred, CMSG_ALIGN,
-            CMSG_DATA, CMSG_FIRSTHDR, CMSG_LEN, CMSG_NXTHDR, CMSG_SPACE,
+            CMSG_ALIGN, CMSG_DATA, CMSG_FIRSTHDR, CMSG_LEN, CMSG_NXTHDR, CMSG_SPACE, cmsghdr,
+            constants::*, msghdr, sa_family_t, sockaddr, socklen_t, ucred,
         },
         sys_time::timeval,
         sys_uio::iovec,
···
                         CallFlags::empty(),
                         &[SocketCall::Unbind as u64],
                     ) {
-                        eprintln!("bind: CRITICAL: failed to unbind socket after a failed transaction: {:?}", unbind_error);
+                        eprintln!(
+                            "bind: CRITICAL: failed to unbind socket after a failed transaction: {:?}",
+                            unbind_error
+                        );
                     }
 
                     return Err(original_error);

src/platform/rlb.rs

···
 use alloc::vec::Vec;
 
-use crate::platform::{types::*, Pal, Sys};
+use crate::platform::{Pal, Sys, types::*};
 
 use crate::{
     error::ResultExt,
-    header::unistd::{lseek, SEEK_SET},
+    header::unistd::{SEEK_SET, lseek},
 };
 /// Implements an `Iterator` which returns on either newline or EOF.
 #[derive(Clone)]

src/platform/test/mod.rs

···
 use crate::platform::{Pal, Sys};
 
 // Stub for call used in exit
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub extern "C" fn pthread_terminate() {}
 
 mod epoll;

src/pthread/mod.rs

···
 
 use core::{
     cell::{Cell, UnsafeCell},
-    mem::{offset_of, MaybeUninit},
-    ptr::{self, addr_of, NonNull},
+    mem::{MaybeUninit, offset_of},
+    ptr::{self, NonNull, addr_of},
     sync::atomic::{AtomicBool, AtomicUsize, Ordering},
 };
 
···
     error::Errno,
     header::{errno::*, pthread as header, sched::sched_param, sys_mman},
     ld_so::{
+        ExpectTlsFree,
         linker::Linker,
         tcb::{Master, Tcb},
-        ExpectTlsFree,
     },
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 
-use crate::sync::{waitval::Waitval, Mutex};
+use crate::sync::{Mutex, waitval::Waitval};
 
 /// Called only by the main thread, as part of relibc_start.
 pub unsafe fn init() {

src/raw_cell.rs

···
         }
     }
     #[inline]
-    pub unsafe fn get(&self) -> T {
-        self.inner.get().read()
-    }
-    #[inline]
-    pub unsafe fn set(&self, t: T) {
-        self.inner.get().write(t)
-    }
-    #[inline]
     pub fn as_mut_ptr(&self) -> *mut T {
         self.inner.get()
     }
···
     #[inline]
     pub fn into_inner(self) -> T {
         self.inner.into_inner()
+    }
+    #[inline]
+    pub unsafe fn unsafe_ref(&self) -> &T {
+        &*self.inner.get()
+    }
+    #[inline]
+    pub unsafe fn unsafe_mut(&self) -> &mut T {
+        &mut *self.inner.get()
     }
 }
 

src/start.rs

···
 use generic_rt::ExpectTlsFree;
 
 use crate::{
+    ALLOCATOR,
     header::{libgen, stdio, stdlib},
     ld_so::{self, linker::Linker, tcb::Tcb},
-    platform::{self, get_auxvs, types::*, Pal, Sys},
+    platform::{self, Pal, Sys, get_auxvs, types::*},
+    raw_cell::RawCell,
     sync::mutex::Mutex,
-    ALLOCATOR,
 };
 
 #[repr(C)]
···
 
 // Since Redox and Linux are so similar, it is easy to accidentally run a binary from one on the
 // other. This will test that the current system is compatible with the current binary
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe fn relibc_verify_host() {
     if !Sys::verify() {
         intrinsics::abort();
     }
 }
-#[link_section = ".init_array"]
+#[unsafe(link_section = ".init_array")]
 #[used]
 static INIT_ARRAY: [extern "C" fn(); 1] = [init_array];
 
 static mut init_complete: bool = false;
 
 #[used]
-#[no_mangle]
+#[unsafe(no_mangle)]
 static mut __relibc_init_environ: *mut *mut c_char = ptr::null_mut();
 
 fn alloc_init() {
···
 }
 
 #[inline(never)]
-#[no_mangle]
+#[unsafe(no_mangle)]
 pub unsafe extern "C" fn relibc_start_v1(
     sp: &'static Stack,
     main: unsafe extern "C" fn(
···
         envp: *mut *mut c_char,
     ) -> c_int,
 ) -> ! {
-    extern "C" {
+    unsafe extern "C" {
         static __preinit_array_start: extern "C" fn();
         static __preinit_array_end: extern "C" fn();
         static __init_array_start: extern "C" fn();
···
     // Set up argc and argv
     let argc = sp.argc;
     let argv = sp.argv();
-    platform::inner_argv = copy_string_array(argv, argc as usize);
-    platform::argv = platform::inner_argv.as_mut_ptr();
+    *platform::inner_argv.as_mut_ptr() = copy_string_array(argv, argc as usize);
+    platform::argv = platform::inner_argv.unsafe_mut().as_mut_ptr();
     // Special code for program_invocation_name and program_invocation_short_name
-    if let Some(arg) = platform::inner_argv.get(0) {
+    if let Some(arg) = platform::inner_argv.unsafe_ref().get(0) {
         platform::program_invocation_name = *arg;
         platform::program_invocation_short_name = libgen::basename(*arg);
     }
···
         while !(*envp.add(len)).is_null() {
             len += 1;
         }
-        platform::OUR_ENVIRON = copy_string_array(envp, len);
-        platform::environ = platform::OUR_ENVIRON.as_mut_ptr();
+        *platform::OUR_ENVIRON.as_mut_ptr() = copy_string_array(envp, len);
+        platform::environ = platform::OUR_ENVIRON.unsafe_mut().as_mut_ptr();
     }
 
     let auxvs = get_auxvs(sp.auxv().cast());

src/sync/mod.rs

···
         time::timespec,
     },
     out::Out,
-    platform::{types::*, Pal, Sys},
+    platform::{Pal, Sys, types::*},
 };
 use core::{
     mem::MaybeUninit,

src/sync/pthread_mutex.rs

···
     pthread::*,
 };
 
-use crate::platform::{types::*, Pal, Sys};
+use crate::platform::{Pal, Sys, types::*};
 
 use super::FutexWaitResult;
 

src/sync/semaphore.rs

···
 //TODO: improve implementation
 
 use crate::{
-    header::time::{clock_gettime, timespec, CLOCK_MONOTONIC},
+    header::time::{CLOCK_MONOTONIC, clock_gettime, timespec},
     platform::types::*,
 };
 

tests/Cargo.toml

···
 name = "relibc-tests"
 version = "0.1.0"
 authors = ["Jeremy Soller <[e-mail]>"]
-edition = "2018"
+edition = "2024"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html