`unsafe` correctness