Spec a safe Rust port of a C decoder

Your team is porting a C library that decodes an image format to Rust, one function at a time, for memory safety. An agent translates each function. Its first output compiles and passes the tests, but it is mostly unsafe blocks with raw pointer arithmetic copied from the C.

Write the rules you would give the agent for every function it ports, and say how you will check its work.

What you know:

• the library exposes 14 public functions, called from a C++ app that cannot change yet
• you have 30,000 real images, plus about 300 known-bad files from past security bugs
• the C code has hand-written SIMD for 2 hot loops
• the team wants to ship each ported function when it is ready, not all at once

Then, in a few sentences: why is the first output no safer than the C?