Which is worse?

• Entire driver written in a non memory safe language?
• The interface to the rest of the kernel is marked as unsafe and then the other X percent is safe from memory corruption?

Surely if X > 0 then this is still a net improvement?