diff --git a/local/recipes/drivers/redox-driver-sys/source/src/memory.rs b/local/recipes/drivers/redox-driver-sys/source/src/memory.rs
index 9b50d0aaf5..e9fcb830d0 100644
--- a/local/recipes/drivers/redox-driver-sys/source/src/memory.rs
+++ b/local/recipes/drivers/redox-driver-sys/source/src/memory.rs
@@ -44,6 +44,13 @@ bitflags::bitflags! {
 // 2. The FD is opened with FD_CLOEXEC — children after exec(2) do not inherit it.
 // 3. This code MUST NOT be used in processes that fork() without exec() —
 //    the child would share the same FD table slot, risking double-close.
+//
+// SAFETY for the `static MEMORY_ROOT_FD: AtomicPtr<()>`:
+//   - The pointer is read-only after first initialization (`Ordering::Acquire`).
+//   - The pointer value is either null (uninitialized) or a valid fd cast to
+//     `*mut ()`. It is never aliased to any other allocation.
+//   - The cast from `usize` (raw fd) to `*mut ()` is valid because we never
+//     dereference the pointer; we only round-trip it through `libredox::call::dup`.
 static MEMORY_ROOT_FD: AtomicPtr<()> = AtomicPtr::new(ptr::null_mut());
 
 fn ensure_memory_root() -> Result<libredox::Fd> {