Assume a hypothetical C library returns a pointer and a length. For a single-threaded call sequence, its buffer is readable and valid until the next library call. Assume no ownership transfer. Whether another handle, a callback, or a background thread can invalidate it is still unverified.
A pointer to const bytes restricts mutation through that access path. It does not establish the buffer's lifetime or rule out changes through another path. Keeping the library handle alive might therefore be necessary and still insufficient.
One possible wrapper copies the bytes into an owned Vec<u8> before allowing another call. The pointer and length still need to describe a valid readable range throughout the copy, with no conflicting foreign mutation. Copying cannot repair an already invalid pointer.
A borrowed view would need to prevent every call capable of invalidating it for as long as the view exists. A borrow tied to one handle only works if all relevant invalidation goes through that handle. If the library uses shared global storage, another handle matters too. Concurrent calls and reentrant callbacks belong in that argument.
I would start with the owned copy and document the foreign guarantees it still requires. That is a proposed boundary, not evidence that the foreign side honors it.
