Hi, NonNull is a very good way to add a bit more safety for unsafe rust. The problem with it is that it comes at a cost of mutability safety.
If you use NonNull you don't need to worry about checking for nullness but now you need to have a mind map of what is *mut and what is *const.
I propose to split NonNull into NonNullConst and NonNullMut such that NonNullConst won't have any function exposing a mutable pointer/reference. that way you can benefit from both nulnness safety and mutability safety.