> It could fail if the generated C code triggered Undefined Behavior.

> For example, signed overflow is UB in C, but defined in Rust. Generated code can't simply use the + operator.

Obviously, yes, but it could generate overflow checks.