Shouldn't `pureMalloc` at https://dlang.org/library/core/memory/pure_malloc.html be @system instead of @trusted? Because it returns uninitialized memory just like T x = void; does, which is not allowed in @safe code.