Typesafe BufferHandle

I don't think we need unsafe here. Why not just constructing it anew from the raw handle?