diff --git a/local/recipes/drivers/redox-driver-sys/source/src/pcid_client.rs b/local/recipes/drivers/redox-driver-sys/source/src/pcid_client.rs
index 7b6e8103e5..a0187572a1 100644
--- a/local/recipes/drivers/redox-driver-sys/source/src/pcid_client.rs
+++ b/local/recipes/drivers/redox-driver-sys/source/src/pcid_client.rs
@@ -97,6 +97,11 @@ impl PcidClient {
     }
 
     fn connect_common(channel_fd: RawFd) -> Self {
+        // SAFETY: `from_raw_fd` is unsafe because the caller must guarantee that
+        // `channel_fd` is a valid open file descriptor not aliased by any other
+        // owned File. The two callers (`connect` and `connect_by_path`) both open
+        // a fresh fd via `libredox::call::open`/`openat` and pass it through
+        // here exactly once, transferring ownership to the returned File.
         let channel = unsafe { File::from_raw_fd(channel_fd) };
         Self { channel }
     }