Here is a different take on the direct framebuffer interface:

• A low-level (pointer, length) pair is returned instead of a high-level slice, since providing a slice gives the user the wrong impression that non-volatile writes are okay.
• The unsafety barrier is shifted from the GOP to its client. After all, GraphicsOutput::framebuffer() is perfectly safe per se in the sense that there is no incorrect input or wrong call circumstance that will cause it to do unsafe things. It is the caller who is going unsafe by writing into the framebuffer after that.

Longer-term, the interface could be improved further by providing a more ergonomic way to do volatile writes (which would feel closer to the original slice abstraction).