iddqd, or the hardest kind of unsafe Rust

A deep dive into the challenges of writing sound unsafe Rust in generic data structures, using the iddqd library as a case study. iddqd provides maps where keys are borrowed from values, used extensively in Oxide's control plane. The post explains why unsafe generic Rust is uniquely difficult: safe but adversarial trait implementations (like a broken Ord that always returns Equal) can corrupt internal data structures and cause undefined behavior. A concrete bug is walked through where a pathological Ord implementation tricks the map into creating duplicate indexes, leading to unsound mutable aliasing. The fix involves using index as a tie-breaker during B-tree searches and falling back to linear scans. Validation layers include analytical reasoning with SAFETY comments, example-based tests, Miri-based pathological tests, model-based/property-based testing against a NaiveMap oracle, panic safety fault injection, and LLM-driven adversarial review.