unsafe is Rust's escape hatch and its social contract: the standard library, tokio, and every FFI binding contain unsafe blocks wrapped in safe APIs. The Rust-in-Linux-kernel work is precisely this discipline — knowing what invariants you must uphold when the borrow checker cannot check them for you.