Where should we check untrusted pointers into memory?

Based on this question by @wdcui in https://github.com/MSRSSP/litebox/pull/2#discussion_r1945851628 :

I guess the question is who should check it: the shim or litebox or the platform. [...] we need to think about this question.

Generalizing a bit, especially for the POSIX shim, we have a number of untrusted pointers coming from users of the library. These need to have some constraints, that are impossible to actually check due to the design of POSIX APIs (e.g., even if we get a pointer and a buffer length, we don't know if every single element of the buffer within that length is actually valid, and points at the same allocation).

If we have kernel/user separation, this is possibly checkable via an additional layer before it all, but if both litebox and the user code are in the same process, then we possibly might not have any way to perform such a check?

Start with the linked pull-request discussion, then trace how the POSIX shim handles untrusted pointers in both kernel/user-separated and same-process execution modes. Done means documenting which layer owns pointer validation and the constraints that can be enforced for pointer-and-length arguments.