Maybe unsound in watchdog::descriptor::confirm

[lwz23]

Describe the bug

Hello, thank you for your contribution in this project, I am scanning the unsoundness problem in rust project.
I notice the following code:

pub struct OwnedDescriptor {
    segment: Arc<Segment>,
    pub atomic: *const AtomicU64,
    pub mask: u64,
}

pub fn confirm(&self) {
        unsafe {
            (*self.atomic).fetch_or(self.mask, std::sync::atomic::Ordering::SeqCst);
        };
    }

Considering that pub mod watchdog, pub struct OwnedDescriptor + pub atomic: *const AtomicU64,and confirm is also a pub function. I assume that users can directly call this function and control the atomic field. This potential situation could result in (*self.atomic) being operating on a null pointer, I suppose it might trigger undefined behavior (UB). For safety reasons, I felt it necessary to report this issue. If you have performed checks elsewhere that ensure this is safe, please don’t take offense at my raising this issue.
I suggest Several possible fixes:

1. If there is no external usage for OwnedDescriptor, it should not marked as pub at least its atomic field should not be pub.
2. confirm method should add additional check for invalid pointer.
3. mark confirm method as unsafe and proper doc to let users know that they should provide valid Pointers.

To reproduce

1. crate a OwnedDescriptor struct.
2. set the atomic field as null pointer.
3. call confirm method.

System info

I think it can happen in any platform.