# Pre-Pre-RFC: \`#\[zeroize\_on\_return\]\` for function-boundary zeroization

**URL:** <https://internals.rust-lang.org/t/pre-pre-rfc-zeroize-on-return-for-function-boundary-zeroization/24796>\
**Category:** language design\
**Created:** [November 8, 2026, 8:07pm UTC](https://internals.rust-lang.org/t/pre-pre-rfc-zeroize-on-return-for-function-boundary-zeroization/24796 "2026-11-08T20:07:51Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![ais523](https://avatars.discourse-cdn.com/v4/letter/a/a183cd/32.png) [@ais523](https://internals.rust-lang.org/u/ais523)\
**Post date:** [November 9, 2026, 6:26am UTC](https://internals.rust-lang.org/t/pre-pre-rfc-zeroize-on-return-for-function-boundary-zeroization/24796/5 "2026-11-09T06:26:38Z")

</div>

Clearing padding is a little complicated because there are two different cases: a) you return by value a `struct`/`enum` that has padding, and b) you return a reference to something with padding (or return via writing through a reference that's given as an argument).

In case a), there is no conceptual problem with clearing the padding because Rust's existing semantics don't put any requirement on what happens to the padding during a move or copy (and a return by value is technically a move or copy depending on whether the type implements `Copy`).

In case b), however, clearing the padding on function exit would contradict some existing guarantees usable by unsafe code (in particular, writing through a reference to a `struct` doesn't change any padding of that `struct` unless you overwrite the entire `struct`, in which case it might or might not change the padding); additionally, it might not be enough to prevent an information leak (e.g. if another thread is concurrently reading the same memory). If you want to be compatible with Rust's current operational semantics, you would have to instead do the clearing at the time that the function overwrites memory that is externally visible, at a type that has padding, and that might be quite hard to implement.

---

_[View the full topic](https://internals.rust-lang.org/t/pre-pre-rfc-zeroize-on-return-for-function-boundary-zeroization/24796)._