What do kernel subsystem interfaces usually look like? Is there a lot of shared ownership of objects with complex lifetimes (i.e. not just allocated on startup and never freed). Do APIs often require consumers to check invariants themselves? If so then there could be a lot of safety lost at the interface.

The best situations for using Rust modules from C are simple APIs that allow the complexity and danger to be strongly encapsulated.