// FFI entry points use raw pointers throughout. The `ffi_return_err!` macro
// wraps a write through `*mut *mut Error` in an `unsafe` block so it can be
// invoked from safe contexts; that block is flagged as redundant when the
// macro happens to be expanded inside another `unsafe` block.