refactor(profiling): make ErrnoBackup::new safe and document safety invariants

Author: realFlowControl

profiling/src/io/got_macho.rs

@@ -550,8 +550,9 @@ unsafe fn rebind_symbols_in_section(
 fn seg_name(seg: &libc::segment_command_64) -> &str {
     let bytes = &seg.segname;
     let len = bytes.iter().position(|&b| b == 0).unwrap_or(bytes.len());
-    // SAFETY: segment names are always ASCII; cast from &[i8] to &[u8] is safe
-    // because i8 and u8 have the same size and alignment.
+    // SAFETY: `seg.segname` is a fixed 16-byte array that outlives the returned reference.
+    // Casting from `*const c_char` (`*const i8`) to `*const u8` is safe because `i8` and `u8`
+    // have identical size (1 byte) and alignment, and `len` is bounded by the array length.
     let bytes: &[u8] = unsafe { std::slice::from_raw_parts(bytes.as_ptr() as *const u8, len) };
     std::str::from_utf8(bytes).unwrap_or("")
 }

profiling/src/io/mod.rs

@@ -31,13 +31,15 @@ struct ErrnoBackup {
 impl ErrnoBackup {
     /// Snapshots the current `errno` value.
     #[inline]
-    unsafe fn new() -> Self {
+    fn new() -> Self {
+        // SAFETY: libc::__errno_location() (Linux) / libc::__error() (macOS) returns a valid,
+        // non-null pointer to the calling thread's errno lvalue, safe for reading.
         #[cfg(target_os = "linux")]
-        let location = libc::__errno_location();
+        let location = unsafe { libc::__errno_location() };
         #[cfg(target_os = "macos")]
-        let location = libc::__error();
+        let location = unsafe { libc::__error() };
         Self {
-            errno: *location,
+            errno: unsafe { *location },
             location,
         }
     }