Comment by _kb

FFI is inherently unsafe. That interfacing means wrapping the C API in a safe interface based on some set of invariants. If they don't hold, then you're in undefined behaviour territory. See https://doc.rust-lang.org/nomicon/ffi.html for a fairly in-depth rundown.