Callers of std::ffi::CStr::from_ptr are responsible for ensuring that the bytes pointed to by ptr, up through the terminating null byte, do not change during the lifetime of the returned &CStr. This is arguably implicit in the fact that the return value is a shared reference, but it seems to me it would be helpful to spell it out, along with the other stipulations already listed in from_ptr's documentation.