Function guarded_transfer 

pub async fn guarded_transfer<M: RawMutex, I: I2c>(
    bus: &Mutex<M, I>,
    reserved: &impl Reservations,
    lock_timeout: Duration,
    deadline: Duration,
    request: TransferRequest<'_>,
    out: &mut [u8],
) -> Result<usize, Status>

Acquire bus within lock_timeout, refuse the transfer if reserved holds its address, and perform it within deadline.

The reservation is checked after the bus is acquired. Checked before, a transfer could pass while the peripheral is free, wait for the mutex while a procedure begins, and then run inside it. A wait for the bus that outlasts lock_timeout is STATUS_BUSY; a transaction that outlasts deadline is STATUS_BUS_ERROR, and dropping the HAL’s future is how the transaction is abandoned—a HAL whose drop does not reset the controller is not one to use here.