diff --git a/base/trace_event/trace_event_unittest.cc b/base/trace_event/trace_event_unittest.cc
index 10522ed2c26a2..d8556bd5d1aa9 100644
--- a/base/trace_event/trace_event_unittest.cc
+++ b/base/trace_event/trace_event_unittest.cc
@@ -2,10 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifdef UNSAFE_BUFFERS_BUILD
-// TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
-#pragma allow_unsafe_buffers
-#endif
+#include "base/containers/auto_spanification_helper.h"
+#include "base/containers/span.h"
+
+
 
 #include "base/trace_event/trace_event.h"
 
@@ -89,7 +89,7 @@ class TraceEventTestFixture : public testing::Test {
       WaitableEvent* flush_complete_event,
       const scoped_refptr<base::RefCountedString>& events_str,
       bool has_more_events);
-  const Value::Dict* FindMatchingTraceEntry(const JsonKeyValue* key_values);
+  const Value::Dict* FindMatchingTraceEntry(base::span<const JsonKeyValue>key_values);
   const Value::Dict* FindNamePhase(const char* name, const char* phase);
   const Value::Dict* FindNamePhaseKeyValue(const char* name,
                                            const char* phase,
@@ -252,20 +252,22 @@ static bool IsKeyValueInDict(const JsonKeyValue* key_value,
   return false;
 }
 
-static bool IsAllKeyValueInDict(const JsonKeyValue* key_values,
+static bool IsAllKeyValueInDict(base::span<const JsonKeyValue> key_values,
                                 const Value::Dict* dict) {
   // Scan all key_values, they must all be present and equal.
-  while (key_values && key_values->key) {
-    if (!IsKeyValueInDict(key_values, dict)) {
+  for (const auto& key_value : key_values) {
+    if (!key_value.key) {
+      break;
+    }
+    if (!IsKeyValueInDict(&key_value, dict)) {
       return false;
     }
-    ++key_values;
   }
   return true;
 }
 
 const Value::Dict* TraceEventTestFixture::FindMatchingTraceEntry(
-    const JsonKeyValue* key_values) {
+    base::span<const JsonKeyValue>key_values) {
   // Scan all items
   for (const Value& value : trace_parsed_) {
     if (!value.is_dict()) {
diff --git a/media/webrtc/audio_processor.cc b/media/webrtc/audio_processor.cc
index ca55fbc98373f..7af72bafdfd2e 100644
--- a/media/webrtc/audio_processor.cc
+++ b/media/webrtc/audio_processor.cc
@@ -4,12 +4,10 @@
 
 #include <inttypes.h>
 
+#include "base/containers/span.h"
 #include "base/strings/to_string.h"
 
-#ifdef UNSAFE_BUFFERS_BUILD
-// TODO(crbug.com/40285824): Remove this and convert code to safer constructs.
-#pragma allow_unsafe_buffers
-#endif
+
 
 #include <stddef.h>
 #include <stdint.h>
@@ -111,11 +109,13 @@ class AudioProcessorCaptureBus {
 
   media::AudioBus* bus() { return bus_.get(); }
 
-  float* const* channel_ptrs() {
+  base::span<float* const> channel_ptrs() {
     for (int i = 0; i < bus_->channels(); ++i) {
       channel_ptrs_[i] = bus_->channel_span(i).data();
     }
-    return channel_ptrs_.get();
+    return UNSAFE_BUFFERS(
+        base::span(channel_ptrs_.get(),
+                   static_cast<size_t>(bus_->channels())));
   }
 
  private:
@@ -355,7 +355,7 @@ void AudioProcessor::ProcessCapturedAudio(const media::AudioBus& audio_source,
     if (webrtc_audio_processing_) {
       output_bus = output_bus_.get();
       new_volume =
-          ProcessData(process_bus->channel_ptrs(), process_bus->bus()->frames(),
+          ProcessData(process_bus->channel_ptrs().data(), process_bus->bus()->frames(),
                       capture_delay, volume, num_preferred_channels,
                       output_bus->channel_ptrs());
     }
@@ -474,7 +474,7 @@ std::optional<double> AudioProcessor::ProcessData(
     base::TimeDelta capture_delay,
     double volume,
     int num_preferred_channels,
-    float* const* output_ptrs) {
+    base::span<float *const>output_ptrs) {
   DCHECK(webrtc_audio_processing_);
 
   const base::TimeDelta playout_delay = playout_delay_;
@@ -547,7 +547,7 @@ std::optional<double> AudioProcessor::ProcessData(
       output_format_.sample_rate(), num_apm_output_channels);
 
   int err = ap->ProcessStream(process_ptrs, CreateStreamConfig(input_format_),
-                              apm_output_config, output_ptrs);
+                              apm_output_config, output_ptrs.data());
   DCHECK_EQ(err, 0) << "ProcessStream() error: " << err;
 
   // Upmix if the number of channels processed by APM is less than the number
@@ -556,8 +556,13 @@ std::optional<double> AudioProcessor::ProcessData(
     if (num_apm_output_channels == 1) {
       // The right channel is a copy of the left channel. Remaining channels
       // have already been set to zero at initialization.
-      memcpy(&output_ptrs[1][0], &output_ptrs[0][0],
-             output_format_.frames_per_buffer() * sizeof(output_ptrs[0][0]));
+      base::span<float> output_span_ch1 = UNSAFE_BUFFERS(base::span(
+          output_ptrs[1],
+          static_cast<size_t>(output_format_.frames_per_buffer())));
+      base::span<const float> input_span_ch0 = UNSAFE_BUFFERS(base::span(
+          output_ptrs[0],
+          static_cast<size_t>(output_format_.frames_per_buffer())));
+      output_span_ch1.copy_from(input_span_ch0);
     }
   }
 
diff --git a/media/webrtc/audio_processor.h b/media/webrtc/audio_processor.h
index d6f145dc38e23..1129c9df73763 100644
--- a/media/webrtc/audio_processor.h
+++ b/media/webrtc/audio_processor.h
@@ -9,6 +9,7 @@
 #include <optional>
 #include <string_view>
 
+#include "base/containers/span.h"
 #include "base/component_export.h"
 #include "base/files/file.h"
 #include "base/functional/callback.h"
@@ -186,7 +187,7 @@ class COMPONENT_EXPORT(MEDIA_WEBRTC) AudioProcessor {
                                     base::TimeDelta capture_delay,
                                     double volume,
                                     int num_preferred_channels,
-                                    float* const* output_ptrs);
+                                    base::span<float *const>output_ptrs);
 
   // Used as callback from |playout_fifo_| in OnPlayoutData().
   // Called on the playout thread.
diff --git a/mojo/core/test/test_support_impl.cc b/mojo/core/test/test_support_impl.cc
index 3e6e70c7a8a22..48d5f2639176d 100644
--- a/mojo/core/test/test_support_impl.cc
+++ b/mojo/core/test/test_support_impl.cc
@@ -11,6 +11,7 @@
 #include <string>
 #include <string_view>
 
+#include "base/containers/span.h"
 #include "base/check.h"
 #include "base/compiler_specific.h"
 #include "base/files/file_enumerator.h"
@@ -74,10 +75,17 @@ char** TestSupportImpl::EnumerateSourceRootRelativeDirectory(
     names.push_back(name.BaseName().AsUTF8Unsafe());
 
   // |names.size() + 1| for null terminator.
-  char** rv = static_cast<char**>(calloc(names.size() + 1, sizeof(char*)));
-  for (size_t i = 0; i < names.size(); ++i)
-    UNSAFE_TODO(rv[i]) = UNSAFE_TODO(base::strdup(names[i].c_str()));
-  return rv;
+  char** rv_ptr =
+      static_cast<char**>(calloc(names.size() + 1, sizeof(char*)));
+  base::span<char*> rv =
+      UNSAFE_BUFFERS(base::span<char*>(rv_ptr, names.size()));
+  for (size_t i = 0; i < names.size(); ++i) {
+    // SAFETY: The caller of this function is responsible for freeing the
+    // memory allocated by strdup. This is a test utility and this is an
+    // acceptable memory management model here.
+    rv[i] = UNSAFE_BUFFERS(base::strdup(names[i].c_str()));
+  }
+  return rv_ptr;
 }
 
 }  // namespace test
diff --git a/sandbox/linux/services/credentials.cc b/sandbox/linux/services/credentials.cc
index 033f22ab2ac38..a72811e08146b 100644
--- a/sandbox/linux/services/credentials.cc
+++ b/sandbox/linux/services/credentials.cc
@@ -3,10 +3,10 @@
 // found in the LICENSE file.
 
 
-#ifdef UNSAFE_BUFFERS_BUILD
-// TODO(crbug.com/351564777): Remove this and convert code to safer constructs.
-#pragma allow_unsafe_buffers
-#endif
+#include "base/containers/auto_spanification_helper.h"
+#include "base/containers/span.h"
+
+
 
 #include "sandbox/linux/services/credentials.h"
 
@@ -87,12 +87,14 @@ bool ChrootToSafeEmptyDir() {
   // PID namespace). With a process, we can just use /proc/self.
   pid_t pid = -1;
 
-  alignas(16) char stack_buf[PTHREAD_STACK_MIN_CONST];
+  alignas(16) std::array<char, PTHREAD_STACK_MIN_CONST> stack_buf;
 
 #if defined(ARCH_CPU_X86_FAMILY) || defined(ARCH_CPU_ARM_FAMILY) || \
     defined(ARCH_CPU_MIPS_FAMILY)
   // The stack grows downward.
-  void* stack = stack_buf + sizeof(stack_buf);
+  // SAFETY: The stack buffer is a std::array with a known size, so this
+  // pointer arithmetic is safe.
+  void* stack = UNSAFE_BUFFERS(stack_buf.data() + stack_buf.size());
 #else
 #error "Unsupported architecture"
 #endif
diff --git a/third_party/blink/renderer/platform/transforms/transform_operations_test.cc b/third_party/blink/renderer/platform/transforms/transform_operations_test.cc
index 498ae46fc97d6..4c74415853ce6 100644
--- a/third_party/blink/renderer/platform/transforms/transform_operations_test.cc
+++ b/third_party/blink/renderer/platform/transforms/transform_operations_test.cc
@@ -114,9 +114,11 @@ TEST(TransformOperationsTest, AbsoluteAnimatedTranslatedBoundsTest) {
 }
 
 TEST(TransformOperationsTest, EmpiricalAnimatedTranslatedBoundsTest) {
-  float test_transforms[][2][3] = {{{0, 0, 0}, {10, 10, 0}},
-                                   {{-100, 202.5, -32.6}, {43.2, 56.1, 89.75}},
-                                   {{43.2, 56.1, 89.75}, {-100, 202.5, -32.6}}};
+  std::array<std::array<std::array<float, 3>, 2>, 3> test_transforms = {{
+      {{{0, 0, 0}, {10, 10, 0}}},
+      {{{-100, 202.5, -32.6}, {43.2, 56.1, 89.75}}},
+      {{{43.2, 56.1, 89.75}, {-100, 202.5, -32.6}}},
+  }};
 
   // All progressions for animations start and end at 0, 1 respectively,
   // we can go outside of these bounds, but will always at least contain
@@ -129,15 +131,15 @@ TEST(TransformOperationsTest, EmpiricalAnimatedTranslatedBoundsTest) {
       TransformOperations to_ops;
       from_ops.Operations().push_back(
           MakeGarbageCollected<TranslateTransformOperation>(
-              Length::Fixed(UNSAFE_TODO(test_transforms[i])[0][0]),
-              Length::Fixed(UNSAFE_TODO(test_transforms[i])[0][1]),
-              UNSAFE_TODO(test_transforms[i])[0][2],
+              Length::Fixed(test_transforms[i][0][0]),
+              Length::Fixed(test_transforms[i][0][1]),
+              test_transforms[i][0][2],
               TransformOperation::kTranslate3D));
       to_ops.Operations().push_back(
           MakeGarbageCollected<TranslateTransformOperation>(
-              Length::Fixed(UNSAFE_TODO(test_transforms[i])[1][0]),
-              Length::Fixed(UNSAFE_TODO(test_transforms[i])[1][1]),
-              UNSAFE_TODO(test_transforms[i])[1][2],
+              Length::Fixed(test_transforms[i][1][0]),
+              Length::Fixed(test_transforms[i][1][1]),
+              test_transforms[i][1][2],
               TransformOperation::kTranslate3D));
       EmpiricallyTestBounds(from_ops, to_ops, progress[j][0], progress[j][1]);
     }
@@ -175,10 +177,12 @@ TEST(TransformOperationsTest, AbsoluteAnimatedScaleBoundsTest) {
 }
 
 TEST(TransformOperationsTest, EmpiricalAnimatedScaleBoundsTest) {
-  float test_transforms[][2][3] = {{{1, 1, 1}, {10, 10, -32}},
-                                   {{1, 2, 5}, {-1, -2, -4}},
-                                   {{0, 0, 0}, {1, 2, 3}},
-                                   {{0, 0, 0}, {0, 0, 0}}};
+  std::array<std::array<std::array<float, 3>, 2>, 4> test_transforms = {{
+      {{{1, 1, 1}, {10, 10, -32}}},
+      {{{1, 2, 5}, {-1, -2, -4}}},
+      {{{0, 0, 0}, {1, 2, 3}}},
+      {{{0, 0, 0}, {0, 0, 0}}},
+  }};
 
   // All progressions for animations start and end at 0, 1 respectively,
   // we can go outside of these bounds, but will always at least contain
@@ -191,15 +195,15 @@ TEST(TransformOperationsTest, EmpiricalAnimatedScaleBoundsTest) {
       TransformOperations to_ops;
       from_ops.Operations().push_back(
           MakeGarbageCollected<TranslateTransformOperation>(
-              Length::Fixed(UNSAFE_TODO(test_transforms[i])[0][0]),
-              Length::Fixed(UNSAFE_TODO(test_transforms[i])[0][1]),
-              UNSAFE_TODO(test_transforms[i])[0][2],
+              Length::Fixed(test_transforms[i][0][0]),
+              Length::Fixed(test_transforms[i][0][1]),
+              test_transforms[i][0][2],
               TransformOperation::kTranslate3D));
       to_ops.Operations().push_back(
           MakeGarbageCollected<TranslateTransformOperation>(
-              Length::Fixed(UNSAFE_TODO(test_transforms[i])[1][0]),
-              Length::Fixed(UNSAFE_TODO(test_transforms[i])[1][1]),
-              UNSAFE_TODO(test_transforms[i])[1][2],
+              Length::Fixed(test_transforms[i][1][0]),
+              Length::Fixed(test_transforms[i][1][1]),
+              test_transforms[i][1][2],
               TransformOperation::kTranslate3D));
       EmpiricallyTestBounds(from_ops, to_ops, progress[j][0], progress[j][1]);
     }
