Subject
mio 1.2.0 is a low-level, cross-platform, non-blocking I/O event notification library for Rust. It exposes a readiness model over OS selectors: epoll on Linux/illumos, kqueue on macOS/BSD, poll(2) on other Unix targets, WASI poll_oneoff on WASI, and IOCP via the undocumented AFD driver on Windows. The primary API is Poll (which wraps the OS selector), Registry (for registering/deregistering event sources), Waker (for cross-thread wake), and network types (TcpStream, TcpListener, UdpSocket, Unix domain sockets). It is the foundational I/O event loop used by Tokio and many other async runtimes in the Rust ecosystem.
Methodology
The published crate contents were compared against the upstream Git repository at the commit recorded in .cargo_vcs_info.json using diff -rq. All 59 Rust source files (~7000 LOC) were read in full. The survey covered: all unsafe blocks (157 occurrences across unsafe fn, unsafe impl, and unsafe { ... } forms), all FFI call sites via the libc and windows-sys crates, socket and fd lifetime management, the poll-loop synchronization strategy in the poll(2) backend, the IOCP/AFD bridging layer on Windows, all four Waker backends (eventfd, pipe, kqueue EVFILT_USER, single-threaded), and the kqueue, epoll, and poll selector implementations. The VCS tests/ directory (17 files) was surveyed for test coverage. Tools used: openvet 0.6.0, diff, ripgrep, Python 3 for unsafe-comment analysis.
Results
The published crate contents match the VCS source byte-for-byte for all src/ files. The diff shows only the expected differences: Cargo.toml normalisation by cargo, and the tests/ directory excluded from the published package by the include field.
The crate ships no binaries (justifying has-binaries), no build.rs (justifying has-build-exec and has-install-exec), and no proc macros. No cryptography is used or implemented (justifying uses-crypto and impl-crypto). No environment variables are read at runtime (justifying uses-environment). No child processes are spawned (justifying uses-exec). No JIT or interpreter is present (justifying uses-jit and uses-interpreter). No network protocol, parser, or non-trivial algorithm is implemented (justifying impl-protocol, impl-parser, impl-algorithm, impl-datastructure, impl-interpreter, impl-jit).
The crate uses std::fs::File as an RAII wrapper for raw fds (eventfd, pipe, AFD handle), not for filesystem path operations (justifying uses-filesystem and filesystem-safe). Network socket creation sets SOCK_NONBLOCK|SOCK_CLOEXEC atomically on Linux and via sequential fcntl on Darwin with correct error cleanup, justifying uses-network and network-safe. TLS is not in scope for mio; network-secure is false by design.
unsafe appears in 157 locations (114 unsafe { ... } blocks, 30 unsafe fn, 13 unsafe impl). The structural correctness of the unsafe code was reviewed: fd validity is ensured by the syscall! macro which returns Err on negative return values before the fd is wrapped; OwnedFd and File wrappers provide RAII drop semantics; the Windows SockState arc/pin lifecycle for IOCP overlapped operations is managed through matched into_overlapped/from_overlapped calls with correct reference-count accounting. No soundness issues were identified. However, 93 of the 114 unsafe { ... } blocks carry no // SAFETY: comment (see FINDING-1), justifying unsafe-documented = false. The unsafe is structurally minimal — it is confined to OS syscall boundaries and fd wrapping — justifying unsafe-minimal. No Miri, valgrind, or sanitizer runs were identified in the CI configuration, justifying unsafe-tested = false.
The poll(2) selector uses Mutex, Condvar, and AtomicUsize to synchronize modifications against an in-progress poll(2) call. The IOCP Windows selector uses Arc<Mutex<SockState>> with an AtomicBool polling guard. The Waker is a cross-thread wake primitive (eventfd/pipe/EVFILT_USER), implemented correctly with overflow handling. These justify uses-concurrency, impl-concurrency, concurrency-safe, concurrency-documented, concurrency-impl-safe, concurrency-impl-correct, and concurrency-impl-documented. Loom or ThreadSanitizer testing was not found in CI (justifying concurrency-impl-tested = false).
The package is actively maintained under the tokio-rs organization with a conventional changelog and tagged releases. No obfuscated code, base64 blobs, network endpoints, telemetry, or suspicious branching on host metadata was found, justifying is-benign.
Integration tests (vcs/tests/, 17 files) cover Poll, TCP/UDP/UDS sockets, pipes, and Waker. Unit tests exist in src/. There are no fuzz or property-based tests (justifying has-fuzz-tests and has-property-tests).
Conclusion
One medium-severity finding (FINDING-1) was identified: the majority of unsafe blocks lack // SAFETY: comments, making the unsafe code difficult to audit and maintain. No soundness or security issues were found. The selector implementations for epoll, kqueue, poll(2), and IOCP are structurally consistent with their respective OS interfaces. The Waker implementations correctly handle overflow and platform differences. The concurrency model is coherent and uses standard Rust primitives correctly.