I've run into two kinds of problems that require unsafe so far.

The first is similar to the c extension you described - building data structures with dynamically-sized arrays eg a bitfield followed by population_count(bitfield) entries. It would be great to have some way to express this without having to pay a whole usize for DST eg:

    struct Node{
        keys: u8,
        vals: [ShortPointer<Node>; popcount(keys)],
    }

The second is dealing with recursive data-structures or algorithms. Even for tree-shaped stuff, if you are hanging onto state as you walk the tree there are some kinds of patterns that the borrow checker just can't deal with eg

    fn join_step<'a>(state: &mut Vec<&'a Value>, ..) {
        ...
        for values in primitive.eval_from_join(&arguments[..], &state[..]).into_iter() {
            // promise the borrow checker that we will pop values before we exit this scope
            let values = unsafe { ::std::mem::transmute::<&Vec<Value>, &'a Vec<Value>>(&values) };
            push_all(state, values);
            if join.constraints[ix].iter().all(|constraint| constraint.is_satisfied_by(&state[..])) {
                join_step(state, ...)
            }
            pop_all(state, values);
        }
    }

It would be nice to have some finer-grained way of making this promise - transmute is overkill and leaves me open to all kinds of mistakes.