How to use as_memref() safely?

[The docs say](https://teaclave.apache.org/api-docs/trustzone-sdk/optee_utee/struct.Parameter.html#method.as_memref):
> The caller must ensure that the raw pointer is valid and points to a properly initialized TEE_Param.

But how can we be sure the raw pointer is valid? An adversarial CA could be mutating the buffer concurrently to the TA reading it, and as such maybe this buffer should instead be considered as a volatile pointer. For that reason, constructing either a &[u8] or a &mut [u8] doesn't seem sound unless we can somehow assume the CA is playing nice, which a TA should never assume. I would think that the *only* safe mechanism here is to copy the buffer into the TA's stack or heap, so maybe the API should be reworked to expose a volatile pointer with a safe function to copy it into a slice?

Also, what is to stop the CA from providing a bogus pointer into the TA's own memory, thereby basically getting the TA to read from its own memory space (instead of from CA controlled memory)?

Please advise.

Start with the Parameter::as_memref documentation and the linked pull request 317, then examine how the raw pointer and buffer validity are handled. Consider the concurrent mutation and bogus-pointer concerns raised in the issue. Done means establishing a maintainer-approved safety contract or API direction.

Written by the indexing model from the issue text.