1 files changed, 8 insertions, 3 deletions

diff --git a/rsnix/src/memory.rs b/rsnix/src/memory.rs
index c80edab..54ff7be 100644
--- a/rsnix/src/memory.rs
+++ b/rsnix/src/memory.rs
@@ -289,7 +289,7 @@ pub fn capture_memory_map(bs: &BootServices) -> Result<usize, Status> {
     let buf_size = buf_size.div_ceil(desc_size) * desc_size;
 
     // If our static buffer is too small, fall back to pool (rare)
-    if buf_size > unsafe { MAP_WORK_BUF.len() } {
+    if buf_size > unsafe { (*core::ptr::addr_of!(MAP_WORK_BUF)).len() } {
         return Err(EFI_BUFFER_TOO_SMALL);
     }
 
@@ -337,7 +337,12 @@ pub fn capture_memory_map(bs: &BootServices) -> Result<usize, Status> {
 }
 
 /// Retry ExitBootServices with a fresh memory map.
-pub fn refresh_and_exit(bs: &BootServices, image_handle: Handle) -> Result<usize, Status> {
+///
+/// # Safety
+///
+/// `image_handle` must be the valid EFI image handle this kernel was
+/// started with (opaque firmware pointer; never dereferenced here).
+pub unsafe fn refresh_and_exit(bs: &BootServices, image_handle: Handle) -> Result<usize, Status> {
     let key = capture_memory_map(bs)?;
     let status = unsafe { (bs.exit_boot_services)(image_handle, key) };
     if status == EFI_SUCCESS {
@@ -591,7 +596,7 @@ pub fn init_page_allocator() -> bool {
 
         // The bitmap itself lives in the heap (one allocation, never freed).
         // `bytes` >= 1 and align 16 is a power of two, so this cannot fail.
-        let layout = unsafe { Layout::from_size_align_unchecked(bytes, 16) };
+        let layout = Layout::from_size_align_unchecked(bytes, 16);
         let bm = ALLOCATOR.alloc(layout);
         if bm.is_null() {
             return false;