diff --git a/base/memory/madv_free_discardable_memory_posix.cc b/base/memory/madv_free_discardable_memory_posix.cc
index 4d75784603abe..a48d20132e0cb 100644
--- a/base/memory/madv_free_discardable_memory_posix.cc
+++ b/base/memory/madv_free_discardable_memory_posix.cc
@@ -2,10 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifdef UNSAFE_BUFFERS_BUILD
-// TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
-#pragma allow_unsafe_buffers
-#endif
+#include "base/containers/span.h"
+
+
 
 #include "base/memory/madv_free_discardable_memory_posix.h"
 
@@ -62,13 +61,17 @@ base::MadvFreeSupport ProbePlatformMadvFreeSupport() {
   // unsupported, regardless of whether the target system actually supports
   // MADV_FREE.
 #if !BUILDFLAG(IS_APPLE) && defined(MADV_FREE)
-  uint8_t* dummy_page = static_cast<uint8_t*>(AllocatePages(1));
+  uint8_t* dummy_page_ptr = static_cast<uint8_t*>(AllocatePages(1));
+  // SAFETY: AllocatePages returns a pointer to a memory region of at least
+  // `base::GetPageSize()` bytes.
+  base::span<uint8_t> dummy_page =
+      UNSAFE_BUFFERS(base::span(dummy_page_ptr, base::GetPageSize()));
   dummy_page[0] = 1;
 
   base::MadvFreeSupport support = base::MadvFreeSupport::kUnsupported;
 
   // Check if the MADV_FREE advice value exists.
-  int retval = madvise(dummy_page, base::GetPageSize(), MADV_FREE);
+  int retval = madvise(dummy_page.data(), dummy_page.size(), MADV_FREE);
   if (!retval) {
     // For Linux 4.5 to 4.12, MADV_FREE on a swapless system will lead to memory
     // being immediately discarded. Verify that the memory was not discarded.
@@ -76,7 +79,7 @@ base::MadvFreeSupport ProbePlatformMadvFreeSupport() {
       support = base::MadvFreeSupport::kSupported;
     }
   }
-  PCHECK(!munmap(dummy_page, base::GetPageSize()));
+  PCHECK(!munmap(dummy_page.data(), dummy_page.size()));
   return support;
 #else
   return base::MadvFreeSupport::kUnsupported;
@@ -177,9 +180,15 @@ bool MadvFreeDiscardableMemoryPosix::LockPage(size_t page_index) {
   static_assert(sizeof(intptr_t) == sizeof(std::atomic<intptr_t>),
                 "Incompatible layout of std::atomic.");
   DCHECK(std::atomic<intptr_t>{}.is_lock_free());
+  // SAFETY: `data_` points to a memory region of at least
+  // `allocated_pages_ * base::GetPageSize()` bytes.
+  base::span<uint8_t> data_span = UNSAFE_BUFFERS(
+      base::span(static_cast<uint8_t*>(data_),
+                 allocated_pages_ * base::GetPageSize()));
+  base::span<uint8_t> page_span =
+      data_span.subspan(page_index * base::GetPageSize(), base::GetPageSize());
   std::atomic<intptr_t>* page_as_atomic =
-      reinterpret_cast<std::atomic<intptr_t>*>(
-          static_cast<uint8_t*>(data_) + page_index * base::GetPageSize());
+      reinterpret_cast<std::atomic<intptr_t>*>(page_span.data());
 
   intptr_t expected = kPageMagicCookie;
 
@@ -200,9 +209,15 @@ bool MadvFreeDiscardableMemoryPosix::LockPage(size_t page_index) {
 void MadvFreeDiscardableMemoryPosix::UnlockPage(size_t page_index) {
   DCHECK(std::atomic<intptr_t>{}.is_lock_free());
 
+  // SAFETY: `data_` points to a memory region of at least
+  // `allocated_pages_ * base::GetPageSize()` bytes.
+  base::span<uint8_t> data_span = UNSAFE_BUFFERS(
+      base::span(static_cast<uint8_t*>(data_),
+                 allocated_pages_ * base::GetPageSize()));
+  base::span<uint8_t> page_span =
+      data_span.subspan(page_index * base::GetPageSize(), base::GetPageSize());
   std::atomic<intptr_t>* page_as_atomic =
-      reinterpret_cast<std::atomic<intptr_t>*>(
-          static_cast<uint8_t*>(data_) + page_index * base::GetPageSize());
+      reinterpret_cast<std::atomic<intptr_t>*>(page_span.data());
 
   // Store the first word of the page for use during unlocking.
   page_first_word_[page_index].store(*page_as_atomic,
@@ -216,9 +231,14 @@ void MadvFreeDiscardableMemoryPosix::DiscardPage(size_t page_index) {
   DFAKE_SCOPED_LOCK(thread_collision_warner_);
   DCHECK(!is_locked_);
   DCHECK(page_index < allocated_pages_);
-  int retval =
-      madvise(static_cast<uint8_t*>(data_) + base::GetPageSize() * page_index,
-              base::GetPageSize(), MADV_DONTNEED);
+  // SAFETY: `data_` points to a memory region of at least
+  // `allocated_pages_ * base::GetPageSize()` bytes.
+  base::span<uint8_t> data_span = UNSAFE_BUFFERS(
+      base::span(static_cast<uint8_t*>(data_),
+                 allocated_pages_ * base::GetPageSize()));
+  base::span<uint8_t> page_span =
+      data_span.subspan(page_index * base::GetPageSize(), base::GetPageSize());
+  int retval = madvise(page_span.data(), page_span.size(), MADV_DONTNEED);
   DPCHECK(!retval);
 }
 
