safe ffi calls