Experimental safe WDM abstraction layer built on wdk-sys - design feedback welcome

[Ar3love (arelove)]

Hellooo everyone,

I've been working on a safe abstraction layer over wdk-sys called wdk-safe
and wanted to share it here and get some feedback from people who actually
know this space.

The main idea was simple — instead of relying on documentation to enforce
kernel invariants, encode them directly in the type system so the compiler
catches mistakes before they become BSODs.

Three things I'm most curious about:

1. Linear IRP ownership — Irp<C> consumes itself on complete(),
   so double-complete is a compile error. There's also a #[must_use]
   drop bomb in debug builds if you forget to complete an IRP.

2. IrpCompleter trait — decouples IoCompleteRequest from the core
   logic, so the full test suite runs on any Windows host without a WDK
   installed. Found this really useful during development.

3. define_ioctl! macro — instead of passing around untyped *mut u8
   buffers, you declare input/output types at the call site.

I know wdk crate is the official direction and this isn't meant to compete
with it — more like one possible answer to "what could the ergonomic layer
above wdk-sys look like."

Repo: https://github.com/arelove/wdk-safe

Would love any feedback — including "this doesn't make sense" or
"we already thought about this and here's why we went differently."
Both are useful to me.

[jdoubleu (jdoubleu)]

I recently stumbled upon this paper:

Cot, C., Portase, R., Coleşa, A. (2026). Rust in the Kernel: A Practical Evaluation on Windows. In: D'Arco, P., Zamfiroiu, A. (eds) Innovative Security Solutions for Information Technology and Communications. SecITC 2025. Lecture Notes in Computer Science, vol 16443. Springer, Cham. https://doi.org/10.1007/978-3-032-17443-7_19

They've also implement their own abstraction layer on top of windows-driver-rs: https://github.com/CotCatalin15/windows-driver-rust-framework.
Maybe some of the learnings and the implementation might be useful.