> The kind of "safe Rust" where you never use `unsafe` and never call into a C library is theoretical. None of the major ports of software to Rust achieve that.

An entire program ported to Rust will call into unsafe APIs in at least a few places, somewhere down the call stacks.

But you'll still have swathes of code that doesn't ultimately end up calling an unsafe API, which can be trivially considered memory safe.