Function sntrup_sys_randombytes 

#[unsafe(no_mangle)]
pub unsafe extern "C" fn sntrup_sys_randombytes(
    buf: *mut u8,
    buf_len: u64,
)

Safety

buf must be valid for writes of buf_len bytes and not aliased by any other live reference for the duration of this call. The vendored C code upholds this by construction (it always passes a real buffer of exactly buf_len bytes) but Rust can’t verify that across the FFI boundary, so the contract is on the caller, hence unsafe fn.