diff --git a/components/gwp_asan/crash_handler/crash_handler_unittest.cc b/components/gwp_asan/crash_handler/crash_handler_unittest.cc
index 621a2911fc48f..9afbd88951317 100644
--- a/components/gwp_asan/crash_handler/crash_handler_unittest.cc
+++ b/components/gwp_asan/crash_handler/crash_handler_unittest.cc
@@ -2,10 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifdef UNSAFE_BUFFERS_BUILD
-// TODO(crbug.com/40285824): Remove this and convert code to safer constructs.
-#pragma allow_unsafe_buffers
-#endif
+#include "base/containers/span.h"
+
+
 
 #include "components/gwp_asan/crash_handler/crash_handler.h"
 
@@ -156,9 +155,10 @@ MULTIPROCESS_TEST_MAIN(CrashingProcess) {
       memory_ranges.insert(memory_ranges.end(), detector_memory_ranges.begin(),
                            detector_memory_ranges.end());
     }
-    auto* range_array =
-        new crashpad::SanitizationAllowedMemoryRanges::Range[memory_ranges
-                                                                 .size()];
+    std::vector<crashpad::SanitizationAllowedMemoryRanges::Range>
+        range_array_vector(memory_ranges.size());
+    base::span<crashpad::SanitizationAllowedMemoryRanges::Range> range_array =
+        range_array_vector;
     for (size_t i = 0; i < memory_ranges.size(); i++) {
       range_array[i].base =
           reinterpret_cast<crashpad::VMAddress>(memory_ranges[i].first);
@@ -166,7 +166,7 @@ MULTIPROCESS_TEST_MAIN(CrashingProcess) {
     }
     allowed_memory_ranges.size = memory_ranges.size();
     allowed_memory_ranges.entries =
-        reinterpret_cast<crashpad::VMAddress>(range_array);
+        reinterpret_cast<crashpad::VMAddress>(range_array.data());
     sanitization_info.allowed_memory_ranges_address =
         reinterpret_cast<crashpad::VMAddress>(&allowed_memory_ranges);
     arguments.push_back(base::StringPrintf("--sanitization-information=%p",
@@ -246,12 +246,12 @@ MULTIPROCESS_TEST_MAIN(CrashingProcess) {
       // Avoid these issues by underflowing with an actual negative value. This
       // is still UB (thus the crash), but requires knowledge of `ptr` to
       // observe, so a non-ASan compiler does not interfere with it in practice.
-      ((unsigned char*)ptr)[-static_cast<ptrdiff_t>(i)] = 0;
+      UNSAFE_TODO(((unsigned char*)ptr)[-static_cast<ptrdiff_t>(i)] = 0);
     }
   } else if (test_name == "Overflow") {
     void* ptr = gpa->Allocate(kAllocationSize);
     for (size_t i = 0; i <= base::GetPageSize(); i++) {
-      ((unsigned char*)ptr)[i] = 0;
+      UNSAFE_TODO(((unsigned char*)ptr)[i] = 0);
     }
   } else if (test_name == "UnrelatedException") {
     __builtin_trap();
@@ -475,9 +475,9 @@ class BaseCrashHandlerTest : public base::MultiProcessTest,
     EXPECT_FALSE(proto_.missing_metadata());
 
     EXPECT_TRUE(proto_.has_allocator());
-    if (!strcmp(params_.allocator, "malloc"))
+    if (std::string_view(params_.allocator) == "malloc")
       EXPECT_EQ(proto_.allocator(), Crash_Allocator_MALLOC);
-    else if (!strcmp(params_.allocator, "partitionalloc"))
+    else if (std::string_view(params_.allocator) == "partitionalloc")
       EXPECT_EQ(proto_.allocator(), Crash_Allocator_PARTITIONALLOC);
     else
       ASSERT_TRUE(false) << "Unknown allocator name";
diff --git a/remoting/protocol/pseudo_tcp_unittest.cc b/remoting/protocol/pseudo_tcp_unittest.cc
index a76d5abe7a70e..c7e184ed4883e 100644
--- a/remoting/protocol/pseudo_tcp_unittest.cc
+++ b/remoting/protocol/pseudo_tcp_unittest.cc
@@ -2,13 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifdef UNSAFE_BUFFERS_BUILD
-// TODO(crbug.com/40285824): Remove this and convert to safer constructs.
-// This test code was moved from WebRTC which predates unsafe buffer checks.
-// The unsafe buffer usage is in existing test utilities that directly
-// manipulate network packets for testing the TCP protocol implementation.
-#pragma allow_unsafe_buffers
-#endif
+#include <array>
+#include "base/containers/auto_spanification_helper.h"
+#include "base/containers/span.h"
+#include "base/numerics/safe_conversions.h"
+
+
 
 #include "remoting/protocol/pseudo_tcp.h"
 
@@ -357,12 +356,13 @@ class PseudoTcpTest : public PseudoTcpTestBase {
   }
 
   void ReadData() {
-    char block[kBlockSize];
+    std::array<char, kBlockSize> block;
     int received;
     do {
-      received = remote_.Recv(block, sizeof(block));
-      if (received != -1) {
-        recv_buffer_.insert(recv_buffer_.end(), block, block + received);
+      received = remote_.Recv(block.data(), block.size());
+      if (received > 0) {
+        recv_buffer_.insert(recv_buffer_.end(), block.begin(),
+                            block.begin() + received);
         if (recv_buffer_.size() % 50000 == 0) {
           VLOG(1) << "Received: " << recv_buffer_.size();
         }
@@ -371,13 +371,15 @@ class PseudoTcpTest : public PseudoTcpTestBase {
   }
   void WriteData(bool* done) {
     int sent;
-    char block[kBlockSize];
+    std::array<char, kBlockSize> block;
     do {
       size_t tosend = std::min(static_cast<size_t>(kBlockSize),
                                send_buffer_.size() - send_stream_pos_);
       if (tosend > 0) {
-        memcpy(block, send_buffer_.data() + send_stream_pos_, tosend);
-        sent = local_.Send(block, tosend);
+        base::as_writable_bytes(base::span(block).first(tosend))
+            .copy_from(base::as_bytes(
+                base::span(send_buffer_).subspan(send_stream_pos_, tosend)));
+        sent = local_.Send(block.data(), tosend);
         UpdateLocalClock();
         if (sent != -1) {
           send_stream_pos_ += sent;
@@ -518,12 +520,13 @@ class PseudoTcpTestPingPong : public PseudoTcpTestBase {
   }
 
   void ReadData() {
-    char block[kBlockSize];
+    std::array<char, kBlockSize> block;
     int received;
     do {
-      received = receiver_->Recv(block, sizeof(block));
-      if (received != -1) {
-        recv_buffer_.insert(recv_buffer_.end(), block, block + received);
+      received = receiver_->Recv(block.data(), block.size());
+      if (received > 0) {
+        recv_buffer_.insert(recv_buffer_.end(), block.begin(),
+                            block.begin() + received);
         if (recv_buffer_.size() % 50000 == 0) {
           VLOG(1) << "Received: " << recv_buffer_.size();
         }
@@ -532,7 +535,7 @@ class PseudoTcpTestPingPong : public PseudoTcpTestBase {
   }
   void WriteData() {
     int sent;
-    char block[kBlockSize];
+    std::array<char, kBlockSize> block;
     do {
       size_t tosend = bytes_per_send_
                           ? std::min(static_cast<size_t>(bytes_per_send_),
@@ -540,8 +543,10 @@ class PseudoTcpTestPingPong : public PseudoTcpTestBase {
                           : std::min(static_cast<size_t>(kBlockSize),
                                      send_buffer_.size() - send_stream_pos_);
       if (tosend > 0) {
-        memcpy(block, send_buffer_.data() + send_stream_pos_, tosend);
-        sent = sender_->Send(block, tosend);
+        base::as_writable_bytes(base::span(block).first(tosend))
+            .copy_from(base::as_bytes(
+                base::span(send_buffer_).subspan(send_stream_pos_, tosend)));
+        sent = sender_->Send(block.data(), tosend);
         UpdateLocalClock();
         if (sent != -1) {
           send_stream_pos_ += sent;
@@ -629,13 +634,14 @@ class PseudoTcpTestReceiveWindow : public PseudoTcpTestBase {
   void OnTcpWriteable(PseudoTcp* /* tcp */) override {}
 
   void ReadUntilIOPending() {
-    char block[kBlockSize];
+    std::array<char, kBlockSize> block;
     int received;
 
     do {
-      received = remote_.Recv(block, sizeof(block));
-      if (received != -1) {
-        recv_buffer_.insert(recv_buffer_.end(), block, block + received);
+      received = remote_.Recv(block.data(), block.size());
+      if (received > 0) {
+        recv_buffer_.insert(recv_buffer_.end(), block.begin(),
+                            block.begin() + received);
         if (recv_buffer_.size() % 50000 == 0) {
           VLOG(1) << "Received: " << recv_buffer_.size();
         }
@@ -656,13 +662,15 @@ class PseudoTcpTestReceiveWindow : public PseudoTcpTestBase {
 
   void WriteData() {
     int sent;
-    char block[kBlockSize];
+    std::array<char, kBlockSize> block;
     do {
       size_t tosend = std::min(static_cast<size_t>(kBlockSize),
                                send_buffer_.size() - send_stream_pos_);
       if (tosend > 0) {
-        memcpy(block, send_buffer_.data() + send_stream_pos_, tosend);
-        sent = local_.Send(block, tosend);
+        base::as_writable_bytes(base::span(block).first(tosend))
+            .copy_from(base::as_bytes(
+                base::span(send_buffer_).subspan(send_stream_pos_, tosend)));
+        sent = local_.Send(block.data(), tosend);
         UpdateLocalClock();
         if (sent != -1) {
           send_stream_pos_ += sent;
