you can assume in good faith that this is barely used feature generally but also most implementations are not really vulnerable so they might have checked but couldn't find anything actually wrong, so there might have been a tremendous amount of effort to actually secure most implementation, on the other hand...

Got it why I was downvoted. But honestly don't get why parent is the most voted comment on this thread. Maybe I am just super dumb ...

I guess they should've written in rust.

If nothing else, arguing about "unsafe" between managers, or even lawyers, between orgs, would be fruitful in new ways.

TPM 2.0 first appeared on the market in 2014. Rust first appeared in 2015. And Rust took a while to become a mature system. TPM 2.0 was also an improved version of TPM 1.2, which came out in 2009.

So... maybe if Rust was a decade earlier.

Announced then, sure, that's a fine cutoff date. It did show clear promise before then in servo.

Rust can still be a standard going forward.

Better tools, better programs, Rust lang.

For something like TPM, IMO, using a memory safe architecture should be table stakes nowadays. I would go further: the design should be as simple as possible to achieve its requirements, and the implementation should be formally verified.