clarify what is UB

src/what-unsafe-does.md

@@ -16,19 +16,32 @@ to your program. You definitely *should not* invoke Undefined Behavior.
 Unlike C, Undefined Behavior is pretty limited in scope in Rust. All the core
 language cares about is preventing the following things:
 
-* Dereferencing null, dangling, or unaligned pointers
+* Loading from or storing to null, dangling, or unaligned references or raw
+  pointers
+* Performing out-of-bounds arithmetic for the computation of an
+  `enum`/`struct`/array/slice/tuple field address
 * Reading [uninitialized memory][]
 * Breaking the [pointer aliasing rules][]
-* Producing invalid primitive values:
-    * dangling/null references
+* Producing invalid primitive values (either alone or as a field of a compound
+  type such as `enum`/`struct`/array/tuple):
+    * dangling/null/unaligned references
     * null `fn` pointers
     * a `bool` that isn't 0 or 1
     * an undefined `enum` discriminant
     * a `char` outside the ranges [0x0, 0xD7FF] and [0xE000, 0x10FFFF]
-    * A non-utf8 `str`
+    * a non-utf8 `str`
+    * an invalid library type with custom invalid values, such as a `NonNull` or
+      `NonZero*` that is 0
 * Unwinding into another language
 * Causing a [data race][race]
 
+"Producing" a value happens any time a value is assigned, passed to a
+function/primitive operation or returned from a function/primitive operation.
+
+A reference/pointer is "dangling" if not all of the bytes it points to are part
+of the same allocation. The span of bytes it points to is determined by the
+pointer value and the size of the pointee type.
+
 That's it. That's all the causes of Undefined Behavior baked into Rust. Of
 course, unsafe functions and traits are free to declare arbitrary other
 constraints that a program must maintain to avoid Undefined Behavior. For