I just thought about a rule for when a function should verify the device and when not.
What about this:
When a driver function is exposed for externally (is not static) or is a task function, it has to verify the device on entry.