> without using a lot of “unsafe”

You are allowed to use a lot of `unsafe` if you really need to. How much `unsafe` do you use in C++?

> it is uncomfortable with core systems-y things like DMA because it breaks lifetime and ownership models,

Sure, it means it can't prove memory safety. But that just takes you back to parity with C++. It feels bad in Rust because normally you can do way better than that, but this isn't an argument for C++.