appears to always pass a non-null pointer, but soundness across an FFI boundary shouldn't hinge on a producer's discipline — the Rust receiver should null-check. Especially
since the C ABI signature here is the one downstream consumers will rely on indefinitely.
