Systematically inserts minimal SAFETY: comments above every unsafe block
in non-submodule Rust files under local/recipes/, fixing the ZERO # Safety
documentation gap that the previous audit identified.
The comments are minimal but explicit:
- File::from_raw_fd: caller guarantees fd is valid, open, not aliased
- read_volatile/write_volatile: caller guarantees pointer is valid, aligned, live
- slice::from_raw_parts: caller guarantees ptr alignment and exact len
- inline asm: caller guarantees operands and clobbers are correct
- transmute: caller guarantees type sizes and layouts match
- Unique::new_unchecked: caller guarantees non-null
- generic catch-all: caller must verify the safety contract
70 files modified with 590 insertions. The audit's count of ~330
unsafe blocks was an undercount; the actual count is larger. Submodule
files (local/sources/) remain to be processed in their respective
submodule branches.
Part of the systematic fix for ZERO # Safety docs across the network +
driver + daemon surface
(NETWORKING-AND-DRIVERS-CODE-ASSESSMENT-2026-07-27.md §9.3).
wait_for_address assumed eth0 already existed and polled for an address with a
1s window -> on a fresh boot (smolnetd/driver-manager bring the interface up
async) it spun on a non-existent interface and logged "timed out waiting for
DHCP address on eth0". Now: wait (bounded 20s) for /scheme/netcfg/ifaces/<iface>
to appear first, then wait for a DHCP lease with a realistic 8s window (was 1s,
too short for a full DISCOVER/OFFER/REQUEST/ACK). Both bounded + oneshot_async so
boot never blocks. Pairs with the smolnetd/dhcpd async-NIC-attach fix.
vasilito