The Rust for Linux project

IMO this comes mostly from the fact that the bindings expose in a formal way some assumptions that are only informally known in the C codebase. I agree those are *really* painful to read and review (as they are to write...).

However, I often find pure Rust code patches easier to review than pure C patches, assuming knowledge of the underlying code base, as Rust allows for stronger local reasoning. If the patch introduces a call looking like foo(&my_struct), Rust tells me that the contents of my_struct won't change (barring interior mutability) whereas, seeing the exact same call in C, I'll need to know the particulars of foo() in order to judge the soundness of further use of my_struct.