> In any event, at some point, you have to "trust" the C code to abide by > the conventions you prescribe. We're already doing this with _ffi calls > that take "immutable" strings or vectors as inputs. Nothing stops C from > modifying those values. Good point. I'd like to keep this to a minimum, so sticking with no ML pointers held by C code seems good.