Not to mention having to verify the operation of the hardware on which the C
code is running (as per the recent Pentium flap).
This seems orthogonal to whether we use C as the extension
language. Even if we used ML for extensions, the correctness of an
extension still assumes correctness of the hardware on which we are
ultimately running.