“And that’s how we ended up with a crash, caused by unsafe-free Rust code badly interacting with the use of libc elsewhere in the program.”
openssl-probe calls set_var with no unsafe block, and setenv reallocates the environment while another thread reads it. The crash needed an unrelated I/O error at exactly the wrong moment. Each failed CI run hung for six hours. Safe Rust stops at the libc boundary.