diff --git a/.cirrus.yml b/.cirrus.yml
index e772275a2..5f1d55a71 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -29,4 +29,5 @@ freebsd_task:
         -DAUTOTEST=ON \
         -GNinja
       cmake --build . --target install
-      ctest -j50 --output-on-failure --rerun-failed --repeat until-pass:3 || ctest -j50 --output-on-failure --rerun-failed --repeat until-pass:3
+      ctest -j50 --output-on-failure --rerun-failed --repeat until-pass:3 ||
+        ctest -j50 --output-on-failure --rerun-failed --repeat until-pass:6
diff --git a/.clusterfuzzlite/Dockerfile b/.clusterfuzzlite/Dockerfile
index 4fa7632d6..6a70d0d3d 100644
--- a/.clusterfuzzlite/Dockerfile
+++ b/.clusterfuzzlite/Dockerfile
@@ -6,6 +6,7 @@ FROM gcr.io/oss-fuzz-base/base-builder:latest
 RUN apt-get update \
  && apt-get -y install --no-install-suggests --no-install-recommends \
  cmake \
+ ninja-build \
  pkg-config \
  && apt-get clean \
  && rm -rf /var/lib/apt/lists/*
diff --git a/.clusterfuzzlite/build.sh b/.clusterfuzzlite/build.sh
index 9496f15dc..609b2df1a 100644
--- a/.clusterfuzzlite/build.sh
+++ b/.clusterfuzzlite/build.sh
@@ -18,12 +18,18 @@ cd "$WORK"
 ls /usr/local/lib/
 
 # Debug build for asserts
-cmake -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_COMPILER="$CC" \
+cmake -GNinja \
+  -DCMAKE_BUILD_TYPE=Debug \
+  -DCMAKE_C_COMPILER="$CC" \
   -DCMAKE_CXX_COMPILER="$CXX" \
   -DCMAKE_C_FLAGS="$CFLAGS" \
   -DCMAKE_CXX_FLAGS="$CXXFLAGS" \
-  -DBUILD_TOXAV=OFF -DENABLE_SHARED=NO -DBUILD_FUZZ_TESTS=ON \
-  -DDHT_BOOTSTRAP=OFF -DBOOTSTRAP_DAEMON=OFF "$SRC"/c-toxcore
+  -DBUILD_TOXAV=OFF \
+  -DENABLE_SHARED=OFF \
+  -DBUILD_FUZZ_TESTS=ON \
+  -DDHT_BOOTSTRAP=OFF \
+  -DBOOTSTRAP_DAEMON=OFF \
+  "$SRC"/c-toxcore
 
 for TARGET in "${FUZZ_TARGETS[@]}"; do
   # build fuzzer target
diff --git a/.github/scripts/cmake-osx b/.github/scripts/cmake-osx
index 5a44006dc..6bbffefe5 100755
--- a/.github/scripts/cmake-osx
+++ b/.github/scripts/cmake-osx
@@ -10,6 +10,7 @@ brew update
 brew install \
   libconfig \
   libvpx \
+  ninja \
   opus
 
 . ".github/scripts/flags-clang.sh"
@@ -25,7 +26,7 @@ add_flag -Werror
 add_c_flag -Wno-c11-extensions
 add_c_flag -Wno-pre-c11-compat
 
-cmake -B_build -H. \
+cmake -GNinja -B_build -H. \
   -DCMAKE_C_FLAGS="$C_FLAGS" \
   -DCMAKE_CXX_FLAGS="$CXX_FLAGS" \
   -DCMAKE_EXE_LINKER_FLAGS="$LD_FLAGS" \
@@ -38,11 +39,10 @@ cmake -B_build -H. \
   -DUSE_IPV6=OFF \
   -DAUTOTEST=ON
 
-cd _build # pushd
-make "-j$NPROC" -k install
+cmake --build _build
+cmake --install _build
 
 # TODO(iphydf): Investigate if we can get lan discovery to work on macos CI.
 # It works, but CI doesn't let us press the "allow broadcast" button.
-ctest -j50 --output-on-failure --rerun-failed --repeat until-pass:6 -E lan_discovery ||
-  ctest -j50 --output-on-failure --rerun-failed --repeat until-pass:6 -E lan_discovery
-cd - # popd
+ctest --test-dir _build -j50 --output-on-failure --rerun-failed --repeat until-pass:6 -E lan_discovery ||
+  ctest --test-dir _build -j50 --output-on-failure --rerun-failed --repeat until-pass:6 -E lan_discovery
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 337ad7162..d9184afce 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -319,6 +319,10 @@ set(toxcore_SOURCES
   toxcore/onion_client.c
   toxcore/onion_client.h
   toxcore/onion.h
+  toxcore/os_memory.c
+  toxcore/os_memory.h
+  toxcore/os_random.c
+  toxcore/os_random.h
   toxcore/ping_array.c
   toxcore/ping_array.h
   toxcore/ping.c
@@ -340,6 +344,7 @@ set(toxcore_SOURCES
   toxcore/timed_auth.c
   toxcore/timed_auth.h
   toxcore/tox_api.c
+  toxcore/tox_attributes.h
   toxcore/tox.c
   toxcore/tox.h
   toxcore/tox_dispatch.c
@@ -350,12 +355,18 @@ set(toxcore_SOURCES
   toxcore/tox_events.h
   toxcore/tox_log_level.c
   toxcore/tox_log_level.h
+  toxcore/tox_memory.c
+  toxcore/tox_memory.h
+  toxcore/tox_memory_impl.h
   toxcore/tox_options.c
   toxcore/tox_options.h
   toxcore/tox_private.c
   toxcore/tox_private.h
   toxcore/tox_pack.c
   toxcore/tox_pack.h
+  toxcore/tox_random.c
+  toxcore/tox_random.h
+  toxcore/tox_random_impl.h
   toxcore/tox_unpack.c
   toxcore/tox_unpack.h
   toxcore/util.c
@@ -379,7 +390,8 @@ if(EXPERIMENTAL_API)
   set(toxcore_API_HEADERS ${toxcore_API_HEADERS}
     ${toxcore_SOURCE_DIR}/toxcore/tox_dispatch.h^tox
     ${toxcore_SOURCE_DIR}/toxcore/tox_events.h^tox
-    ${toxcore_SOURCE_DIR}/toxcore/tox_private.h^tox)
+    ${toxcore_SOURCE_DIR}/toxcore/tox_private.h^tox
+    ${toxcore_SOURCE_DIR}/toxcore/tox_random.h^tox)
 endif()
 
 ################################################################################
diff --git a/auto_tests/TCP_test.c b/auto_tests/TCP_test.c
index a7c2c7aa2..af10fcbb0 100644
--- a/auto_tests/TCP_test.c
+++ b/auto_tests/TCP_test.c
@@ -10,6 +10,8 @@
 #include "../toxcore/mono_time.h"
 #include "../toxcore/net_profile.h"
 #include "../toxcore/network.h"
+#include "../toxcore/os_memory.h"
+#include "../toxcore/os_random.h"
 #include "auto_test_support.h"
 
 #define NUM_PORTS 3
diff --git a/auto_tests/announce_test.c b/auto_tests/announce_test.c
index 7e387c273..18f61c3f5 100644
--- a/auto_tests/announce_test.c
+++ b/auto_tests/announce_test.c
@@ -2,12 +2,10 @@
 #include <string.h>
 
 #include "../toxcore/announce.h"
-#include "../toxcore/tox.h"
-#include "../testing/misc_tools.h"
 #include "../toxcore/mono_time.h"
 #include "../toxcore/forwarding.h"
-#include "../toxcore/net_crypto.h"
-#include "../toxcore/util.h"
+#include "../toxcore/os_memory.h"
+#include "../toxcore/os_random.h"
 #include "auto_test_support.h"
 #include "check_compat.h"
 
diff --git a/auto_tests/conference_av_test.c b/auto_tests/conference_av_test.c
index 5cf709ede..53c686b25 100644
--- a/auto_tests/conference_av_test.c
+++ b/auto_tests/conference_av_test.c
@@ -7,6 +7,7 @@
 #include <stdint.h>
 
 #include "../toxav/toxav.h"
+#include "../toxcore/os_random.h"
 #include "check_compat.h"
 
 #define NUM_AV_GROUP_TOX 16
diff --git a/auto_tests/conference_test.c b/auto_tests/conference_test.c
index efce44de9..62e9bf61d 100644
--- a/auto_tests/conference_test.c
+++ b/auto_tests/conference_test.c
@@ -6,6 +6,7 @@
 #include <time.h>
 #include <stdint.h>
 
+#include "../toxcore/os_random.h"
 #include "../toxcore/util.h"
 
 #include "check_compat.h"
diff --git a/auto_tests/crypto_test.c b/auto_tests/crypto_test.c
index 75d94ea1b..c03e5dc9d 100644
--- a/auto_tests/crypto_test.c
+++ b/auto_tests/crypto_test.c
@@ -2,9 +2,10 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "../testing/misc_tools.h"
 #include "../toxcore/crypto_core.h"
 #include "../toxcore/net_crypto.h"
+#include "../toxcore/os_memory.h"
+#include "../toxcore/os_random.h"
 #include "check_compat.h"
 
 static void rand_bytes(const Random *rng, uint8_t *b, size_t blen)
diff --git a/auto_tests/dht_nodes_response_api_test.c b/auto_tests/dht_nodes_response_api_test.c
index 5f6e80be4..8acc111f8 100644
--- a/auto_tests/dht_nodes_response_api_test.c
+++ b/auto_tests/dht_nodes_response_api_test.c
@@ -13,6 +13,10 @@
 #include "check_compat.h"
 
 #define NUM_TOXES 30
+// Maximum number of iterations to wait for all nodes to be crawled. 5 should
+// be enough. We pick 10 in case things are slow. This makes the test take
+// less time in case it completely fails, so we can retry it.
+#define MAX_ITERATIONS 10
 
 typedef struct Dht_Node {
     uint8_t  public_key[TOX_DHT_NODE_PUBLIC_KEY_SIZE];
@@ -132,9 +136,15 @@ static void test_dht_nodes_request(AutoTox *autotoxes)
                tox_dht_get_num_closelist_announce_capable(autotoxes[i].tox));
     }
 
-    while (!all_nodes_crawled(autotoxes, NUM_TOXES, public_key_list)) {
+    bool success = false;
+    for (size_t i = 0; i < MAX_ITERATIONS; ++i) {
+        if (all_nodes_crawled(autotoxes, NUM_TOXES, public_key_list)) {
+            success = true;
+            break;
+        }
         iterate_all_wait(autotoxes, NUM_TOXES, ITERATION_INTERVAL);
     }
+    ck_assert_msg(success, "Failed to crawl all nodes within %d iterations", MAX_ITERATIONS);
 
     for (size_t i = 0; i < NUM_TOXES; ++i) {
         State *state = (State *)autotoxes[i].state;
diff --git a/auto_tests/encryptsave_test.c b/auto_tests/encryptsave_test.c
index 5a2f52993..07b797dcd 100644
--- a/auto_tests/encryptsave_test.c
+++ b/auto_tests/encryptsave_test.c
@@ -3,9 +3,9 @@
 #include <string.h>
 #include <sys/types.h>
 
-#include "../testing/misc_tools.h"
 #include "../toxcore/ccompat.h"
 #include "../toxcore/crypto_core.h"
+#include "../toxcore/os_random.h"
 #include "../toxcore/tox.h"
 #include "../toxencryptsave/toxencryptsave.h"
 #include "auto_test_support.h"
diff --git a/auto_tests/forwarding_test.c b/auto_tests/forwarding_test.c
index 8172271ce..754eebd69 100644
--- a/auto_tests/forwarding_test.c
+++ b/auto_tests/forwarding_test.c
@@ -8,7 +8,8 @@
 #include "../toxcore/mono_time.h"
 #include "../toxcore/forwarding.h"
 #include "../toxcore/net_crypto.h"
-#include "../toxcore/util.h"
+#include "../toxcore/os_memory.h"
+#include "../toxcore/os_random.h"
 #include "auto_test_support.h"
 #include "check_compat.h"
 
diff --git a/auto_tests/group_message_test.c b/auto_tests/group_message_test.c
index 09ed34fd8..4b8c1d1d1 100644
--- a/auto_tests/group_message_test.c
+++ b/auto_tests/group_message_test.c
@@ -12,6 +12,7 @@
 
 #include "auto_test_support.h"
 #include "check_compat.h"
+#include "../toxcore/os_random.h"
 #include "../toxcore/util.h"
 
 typedef struct State {
diff --git a/auto_tests/group_sync_test.c b/auto_tests/group_sync_test.c
index e94eb0c0a..cdd154aaf 100644
--- a/auto_tests/group_sync_test.c
+++ b/auto_tests/group_sync_test.c
@@ -10,6 +10,7 @@
 
 #include "auto_test_support.h"
 
+#include "../toxcore/os_random.h"
 #include "../toxcore/tox.h"
 #include "../toxcore/util.h"
 
diff --git a/auto_tests/group_topic_test.c b/auto_tests/group_topic_test.c
index b561847ef..44b765472 100644
--- a/auto_tests/group_topic_test.c
+++ b/auto_tests/group_topic_test.c
@@ -5,14 +5,13 @@
 
 #include <string.h>
 #include <stdio.h>
-#include <stdlib.h>
 #include <stdint.h>
 
 #include "auto_test_support.h"
 #include "check_compat.h"
 
+#include "../toxcore/os_random.h"
 #include "../toxcore/tox.h"
-#include "../toxcore/group_chats.h"
 
 #define NUM_GROUP_TOXES 3
 
diff --git a/auto_tests/network_test.c b/auto_tests/network_test.c
index 72a9408c0..7079120dc 100644
--- a/auto_tests/network_test.c
+++ b/auto_tests/network_test.c
@@ -1,6 +1,7 @@
 #include <string.h>
 
 #include "../toxcore/network.h"
+#include "../toxcore/os_memory.h"
 #include "check_compat.h"
 
 #ifndef USE_IPV6
diff --git a/auto_tests/onion_test.c b/auto_tests/onion_test.c
index 46c70d9e1..b8ff1cab3 100644
--- a/auto_tests/onion_test.c
+++ b/auto_tests/onion_test.c
@@ -6,7 +6,8 @@
 #include "../toxcore/onion.h"
 #include "../toxcore/onion_announce.h"
 #include "../toxcore/onion_client.h"
-#include "../toxcore/util.h"
+#include "../toxcore/os_memory.h"
+#include "../toxcore/os_random.h"
 #include "auto_test_support.h"
 #include "check_compat.h"
 
diff --git a/auto_tests/reconnect_test.c b/auto_tests/reconnect_test.c
index 8a4b31c49..4661ec8f1 100644
--- a/auto_tests/reconnect_test.c
+++ b/auto_tests/reconnect_test.c
@@ -6,13 +6,12 @@
  */
 
 #include <stdlib.h>
-#include <string.h>
 #include <time.h>
 
 #include "../testing/misc_tools.h"
 #include "../toxcore/friend_connection.h"
+#include "../toxcore/os_random.h"
 #include "../toxcore/tox.h"
-#include "../toxcore/util.h"
 #include "check_compat.h"
 
 #define TOX_COUNT 2
diff --git a/auto_tests/save_friend_test.c b/auto_tests/save_friend_test.c
index 339690f2b..5b82c6347 100644
--- a/auto_tests/save_friend_test.c
+++ b/auto_tests/save_friend_test.c
@@ -8,6 +8,7 @@
 #include "../testing/misc_tools.h"
 #include "../toxcore/ccompat.h"
 #include "../toxcore/crypto_core.h"
+#include "../toxcore/os_random.h"
 #include "../toxcore/tox.h"
 #include "auto_test_support.h"
 #include "check_compat.h"
diff --git a/auto_tests/tox_many_tcp_test.c b/auto_tests/tox_many_tcp_test.c
index fb4505d34..217beb37a 100644
--- a/auto_tests/tox_many_tcp_test.c
+++ b/auto_tests/tox_many_tcp_test.c
@@ -2,14 +2,13 @@
  */
 
 #include <stdio.h>
-#include <stdlib.h>
 #include <string.h>
 #include <time.h>
 
 #include "../testing/misc_tools.h"
 #include "../toxcore/crypto_core.h"
+#include "../toxcore/os_random.h"
 #include "../toxcore/tox.h"
-#include "../toxcore/util.h"
 #include "auto_test_support.h"
 #include "check_compat.h"
 
diff --git a/auto_tests/tox_many_test.c b/auto_tests/tox_many_test.c
index 41666119a..63e2ccac3 100644
--- a/auto_tests/tox_many_test.c
+++ b/auto_tests/tox_many_test.c
@@ -2,14 +2,13 @@
  */
 
 #include <stdio.h>
-#include <stdlib.h>
 #include <string.h>
 #include <time.h>
 
 #include "../testing/misc_tools.h"
 #include "../toxcore/crypto_core.h"
+#include "../toxcore/os_random.h"
 #include "../toxcore/tox.h"
-#include "../toxcore/util.h"
 #include "auto_test_support.h"
 #include "check_compat.h"
 
diff --git a/other/DHT_bootstrap.c b/other/DHT_bootstrap.c
index 0d1d6fbe6..feb4dbda2 100644
--- a/other/DHT_bootstrap.c
+++ b/other/DHT_bootstrap.c
@@ -26,6 +26,8 @@
 #include "../toxcore/network.h"
 #include "../toxcore/onion.h"
 #include "../toxcore/onion_announce.h"
+#include "../toxcore/os_memory.h"
+#include "../toxcore/os_random.h"
 #include "../toxcore/tox.h"
 
 #define TCP_RELAY_ENABLED
diff --git a/other/analysis/run-cppcheck b/other/analysis/run-cppcheck
index 0e586ba81..e861851dc 100755
--- a/other/analysis/run-cppcheck
+++ b/other/analysis/run-cppcheck
@@ -24,6 +24,8 @@ CPPCHECK+=("--suppress=knownConditionTrueFalse")
 CPPCHECK+=("--suppress=missingIncludeSystem")
 # TODO(iphydf): Maybe fix?
 CPPCHECK+=("--suppress=signConversion")
+# We have suppressions in the code for the misra extension.
+CPPCHECK+=("--suppress=unmatchedSuppression")
 
 # We use this for VLAs.
 CPPCHECK_CXX+=("--suppress=allocaCalled")
diff --git a/other/bootstrap_daemon/BUILD.bazel b/other/bootstrap_daemon/BUILD.bazel
index 4c6566054..35b09ef27 100644
--- a/other/bootstrap_daemon/BUILD.bazel
+++ b/other/bootstrap_daemon/BUILD.bazel
@@ -25,6 +25,7 @@ cc_binary(
         "//c-toxcore/toxcore:network",
         "//c-toxcore/toxcore:onion",
         "//c-toxcore/toxcore:onion_announce",
+        "//c-toxcore/toxcore:os_random",
         "//c-toxcore/toxcore:tox",
         "@libconfig",
     ],
diff --git a/other/bootstrap_daemon/src/tox-bootstrapd.c b/other/bootstrap_daemon/src/tox-bootstrapd.c
index 6f80e9d64..d1e6fc677 100644
--- a/other/bootstrap_daemon/src/tox-bootstrapd.c
+++ b/other/bootstrap_daemon/src/tox-bootstrapd.c
@@ -36,11 +36,12 @@
 #include "../../../toxcore/group_announce.h"
 #include "../../../toxcore/group_onion_announce.h"
 #include "../../../toxcore/logger.h"
-#include "../../../toxcore/mem.h"
 #include "../../../toxcore/mono_time.h"
 #include "../../../toxcore/network.h"
 #include "../../../toxcore/onion.h"
 #include "../../../toxcore/onion_announce.h"
+#include "../../../toxcore/os_memory.h"
+#include "../../../toxcore/os_random.h"
 
 // misc
 #include "../../bootstrap_node_packets.h"
@@ -283,8 +284,8 @@ int main(int argc, char *argv[])
     IP ip;
     ip_init(&ip, enable_ipv6);
 
-    const Memory *mem = os_memory();
-    const Random *rng = os_random();
+    const Tox_Memory *mem = os_memory();
+    const Tox_Random *rng = os_random();
     const Network *ns = os_network();
 
     Logger *logger = logger_new(mem);
diff --git a/testing/BUILD.bazel b/testing/BUILD.bazel
index b8c1a2ba5..5269d7363 100644
--- a/testing/BUILD.bazel
+++ b/testing/BUILD.bazel
@@ -87,6 +87,8 @@ cc_binary(
         "//c-toxcore/toxcore:Messenger",
         "//c-toxcore/toxcore:ccompat",
         "//c-toxcore/toxcore:mono_time",
+        "//c-toxcore/toxcore:os_memory",
+        "//c-toxcore/toxcore:os_random",
     ],
 )
 
diff --git a/testing/Messenger_test.c b/testing/Messenger_test.c
index 9e6484e86..bbb2a4179 100644
--- a/testing/Messenger_test.c
+++ b/testing/Messenger_test.c
@@ -35,6 +35,8 @@
 #include "../toxcore/Messenger.h"
 #include "../toxcore/ccompat.h"
 #include "../toxcore/mono_time.h"
+#include "../toxcore/os_memory.h"
+#include "../toxcore/os_random.h"
 #include "misc_tools.h"
 
 static void print_message(Messenger *m, uint32_t friendnumber, unsigned int type, const uint8_t *string, size_t length,
diff --git a/testing/fuzzing/fuzz_support.cc b/testing/fuzzing/fuzz_support.cc
index 904d54249..6e43f871b 100644
--- a/testing/fuzzing/fuzz_support.cc
+++ b/testing/fuzzing/fuzz_support.cc
@@ -24,7 +24,9 @@
 
 #include "../../toxcore/crypto_core.h"
 #include "../../toxcore/network.h"
+#include "../../toxcore/tox_memory_impl.h"
 #include "../../toxcore/tox_private.h"
+#include "../../toxcore/tox_random_impl.h"
 #include "func_conversion.hh"
 
 // TODO(iphydf): Put this somewhere shared.
@@ -33,8 +35,8 @@ struct Network_Addr {
     size_t size;
 };
 
-System::System(std::unique_ptr<Tox_System> in_sys, std::unique_ptr<Memory> in_mem,
-    std::unique_ptr<Network> in_ns, std::unique_ptr<Random> in_rng)
+System::System(std::unique_ptr<Tox_System> in_sys, std::unique_ptr<Tox_Memory> in_mem,
+    std::unique_ptr<Network> in_ns, std::unique_ptr<Tox_Random> in_rng)
     : sys(std::move(in_sys))
     , mem(std::move(in_mem))
     , ns(std::move(in_ns))
@@ -94,22 +96,17 @@ static void *alloc_common(const char *func, std::size_t size, Fuzz_Data &data, A
     return report_alloc("tox1", func, size, Func(args...));
 }
 
-static constexpr Memory_Funcs fuzz_memory_funcs = {
+static constexpr Tox_Memory_Funcs fuzz_memory_funcs = {
     /* .malloc = */
     ![](Fuzz_System *self, uint32_t size) {
         return alloc_common<decltype(std::malloc), std::malloc>("malloc", size, self->data, size);
     },
-    /* .calloc = */
-    ![](Fuzz_System *self, uint32_t nmemb, uint32_t size) {
-        return alloc_common<decltype(std::calloc), std::calloc>(
-            "calloc", nmemb * size, self->data, nmemb, size);
-    },
     /* .realloc = */
     ![](Fuzz_System *self, void *ptr, uint32_t size) {
         return alloc_common<decltype(std::realloc), std::realloc>(
             "realloc", size, self->data, ptr, size);
     },
-    /* .free = */
+    /* .dealloc = */
     ![](Fuzz_System *self, void *ptr) { std::free(ptr); },
 };
 
@@ -172,8 +169,8 @@ static constexpr Network_Funcs fuzz_network_funcs = {
     },
 };
 
-static constexpr Random_Funcs fuzz_random_funcs = {
-    /* .random_bytes = */
+static constexpr Tox_Random_Funcs fuzz_random_funcs = {
+    /* .bytes_callback = */
     ![](Fuzz_System *self, uint8_t *bytes, size_t length) {
         // Initialize the buffer with zeros in case there's no randomness left.
         std::fill_n(bytes, length, 0);
@@ -216,11 +213,11 @@ static constexpr Random_Funcs fuzz_random_funcs = {
             }
         }
     },
-    /* .random_uniform = */
+    /* .uniform_callback = */
     ![](Fuzz_System *self, uint32_t upper_bound) {
         uint32_t randnum = 0;
         if (upper_bound > 0) {
-            self->rng->funcs->random_bytes(
+            self->rng->funcs->bytes_callback(
                 self, reinterpret_cast<uint8_t *>(&randnum), sizeof(randnum));
             randnum %= upper_bound;
         }
@@ -231,9 +228,9 @@ static constexpr Random_Funcs fuzz_random_funcs = {
 Fuzz_System::Fuzz_System(Fuzz_Data &input)
     : System{
         std::make_unique<Tox_System>(),
-        std::make_unique<Memory>(Memory{&fuzz_memory_funcs, this}),
+        std::make_unique<Tox_Memory>(Tox_Memory{&fuzz_memory_funcs, this}),
         std::make_unique<Network>(Network{&fuzz_network_funcs, this}),
-        std::make_unique<Random>(Random{&fuzz_random_funcs, this}),
+        std::make_unique<Tox_Random>(Tox_Random{&fuzz_random_funcs, this}),
     }
     , data(input)
 {
@@ -244,14 +241,12 @@ Fuzz_System::Fuzz_System(Fuzz_Data &input)
     sys->rng = rng.get();
 }
 
-static constexpr Memory_Funcs null_memory_funcs = {
+static constexpr Tox_Memory_Funcs null_memory_funcs = {
     /* .malloc = */
     ![](Null_System *self, uint32_t size) { return std::malloc(size); },
-    /* .calloc = */
-    ![](Null_System *self, uint32_t nmemb, uint32_t size) { return std::calloc(nmemb, size); },
     /* .realloc = */
     ![](Null_System *self, void *ptr, uint32_t size) { return std::realloc(ptr, size); },
-    /* .free = */
+    /* .dealloc = */
     ![](Null_System *self, void *ptr) { std::free(ptr); },
 };
 
@@ -304,14 +299,14 @@ static uint64_t simple_rng(uint64_t &seed)
     return seed;
 }
 
-static constexpr Random_Funcs null_random_funcs = {
-    /* .random_bytes = */
+static constexpr Tox_Random_Funcs null_random_funcs = {
+    /* .bytes_callback = */
     ![](Null_System *self, uint8_t *bytes, size_t length) {
         for (size_t i = 0; i < length; ++i) {
             bytes[i] = simple_rng(self->seed) & 0xff;
         }
     },
-    /* .random_uniform = */
+    /* .uniform_callback = */
     ![](Null_System *self, uint32_t upper_bound) {
         return static_cast<uint32_t>(simple_rng(self->seed)) % upper_bound;
     },
@@ -320,9 +315,9 @@ static constexpr Random_Funcs null_random_funcs = {
 Null_System::Null_System()
     : System{
         std::make_unique<Tox_System>(),
-        std::make_unique<Memory>(Memory{&null_memory_funcs, this}),
+        std::make_unique<Tox_Memory>(Tox_Memory{&null_memory_funcs, this}),
         std::make_unique<Network>(Network{&null_network_funcs, this}),
-        std::make_unique<Random>(Random{&null_random_funcs, this}),
+        std::make_unique<Tox_Random>(Tox_Random{&null_random_funcs, this}),
     }
 {
     sys->mono_time_callback = [](void *self) { return static_cast<Null_System *>(self)->clock; };
@@ -342,23 +337,18 @@ static uint16_t get_port(const Network_Addr *addr)
     }
 }
 
-static constexpr Memory_Funcs record_memory_funcs = {
+static constexpr Tox_Memory_Funcs record_memory_funcs = {
     /* .malloc = */
     ![](Record_System *self, uint32_t size) {
         self->push(true);
         return report_alloc(self->name_, "malloc", size, std::malloc(size));
     },
-    /* .calloc = */
-    ![](Record_System *self, uint32_t nmemb, uint32_t size) {
-        self->push(true);
-        return report_alloc(self->name_, "calloc", nmemb * size, std::calloc(nmemb, size));
-    },
     /* .realloc = */
     ![](Record_System *self, void *ptr, uint32_t size) {
         self->push(true);
         return report_alloc(self->name_, "realloc", size, std::realloc(ptr, size));
     },
-    /* .free = */
+    /* .dealloc = */
     ![](Record_System *self, void *ptr) { std::free(ptr); },
 };
 
@@ -448,8 +438,8 @@ static constexpr Network_Funcs record_network_funcs = {
          size_t optlen) { return 0; },
 };
 
-static constexpr Random_Funcs record_random_funcs = {
-    /* .random_bytes = */
+static constexpr Tox_Random_Funcs record_random_funcs = {
+    /* .bytes_callback = */
     ![](Record_System *self, uint8_t *bytes, size_t length) {
         for (size_t i = 0; i < length; ++i) {
             bytes[i] = simple_rng(self->seed_) & 0xff;
@@ -460,14 +450,14 @@ static constexpr Random_Funcs record_random_funcs = {
                 "%s: rng: %02x..%02x[%zu]\n", self->name_, bytes[0], bytes[length - 1], length);
         }
     },
-    /* .random_uniform = */
-    fuzz_random_funcs.random_uniform,
+    /* .uniform_callback = */
+    fuzz_random_funcs.uniform_callback,
 };
 
 Record_System::Record_System(Global &global, uint64_t seed, const char *name)
     : System{
         std::make_unique<Tox_System>(),
-        std::make_unique<Memory>(Memory{&record_memory_funcs, this}),
+        std::make_unique<Tox_Memory>(Tox_Memory{&record_memory_funcs, this}),
         std::make_unique<Network>(Network{&record_network_funcs, this}),
         std::make_unique<Random>(Random{&record_random_funcs, this}),
     }
diff --git a/testing/fuzzing/fuzz_support.hh b/testing/fuzzing/fuzz_support.hh
index 1e03abf5b..cff634b5e 100644
--- a/testing/fuzzing/fuzz_support.hh
+++ b/testing/fuzzing/fuzz_support.hh
@@ -187,9 +187,9 @@ void fuzz_select_target(const uint8_t *data, std::size_t size)
     return Fuzz_Target_Selector<Args...>::select(selector, input);
 }
 
-struct Memory;
+struct Tox_Memory;
 struct Network;
-struct Random;
+struct Tox_Random;
 
 struct System {
     /** @brief Deterministic system clock for this instance.
@@ -205,12 +205,12 @@ struct System {
     uint64_t clock = 1000000000;
 
     std::unique_ptr<Tox_System> sys;
-    std::unique_ptr<Memory> mem;
+    std::unique_ptr<Tox_Memory> mem;
     std::unique_ptr<Network> ns;
-    std::unique_ptr<Random> rng;
+    std::unique_ptr<Tox_Random> rng;
 
-    System(std::unique_ptr<Tox_System> sys, std::unique_ptr<Memory> mem,
-        std::unique_ptr<Network> ns, std::unique_ptr<Random> rng);
+    System(std::unique_ptr<Tox_System> sys, std::unique_ptr<Tox_Memory> mem,
+        std::unique_ptr<Network> ns, std::unique_ptr<Tox_Random> rng);
     System(System &&);
 
     // Not inline because sizeof of the above 2 structs is not known everywhere.
diff --git a/toxav/BUILD.bazel b/toxav/BUILD.bazel
index 90fb40d71..f213c5148 100644
--- a/toxav/BUILD.bazel
+++ b/toxav/BUILD.bazel
@@ -68,6 +68,19 @@ cc_library(
     ],
 )
 
+cc_test(
+    name = "rtp_test",
+    size = "small",
+    srcs = ["rtp_test.cc"],
+    deps = [
+        ":toxav",
+        "//c-toxcore/toxcore:crypto_core",
+        "//c-toxcore/toxcore:os_random",
+        "@com_google_googletest//:gtest",
+        "@com_google_googletest//:gtest_main",
+    ],
+)
+
 sh_library(
     name = "cimple_files",
     srcs = glob([
diff --git a/toxav/rtp_test.cc b/toxav/rtp_test.cc
index 674bc4b46..24e524480 100644
--- a/toxav/rtp_test.cc
+++ b/toxav/rtp_test.cc
@@ -3,6 +3,7 @@
 #include <gtest/gtest.h>
 
 #include "../toxcore/crypto_core.h"
+#include "../toxcore/os_random.h"
 
 namespace {
 
diff --git a/toxav/toxav.c b/toxav/toxav.c
index f751ce19a..4e2eaaec3 100644
--- a/toxav/toxav.c
+++ b/toxav/toxav.c
@@ -77,7 +77,7 @@ typedef struct DecodeTimeStats {
 } DecodeTimeStats;
 
 struct ToxAV {
-    const Memory *mem;
+    const struct Tox_Memory *mem;
     Logger *log;
     Tox *tox;
     MSISession *msi;
diff --git a/toxcore/BUILD.bazel b/toxcore/BUILD.bazel
index 580d8884f..87f27d941 100644
--- a/toxcore/BUILD.bazel
+++ b/toxcore/BUILD.bazel
@@ -39,6 +39,12 @@ cc_library(
     visibility = ["//c-toxcore:__subpackages__"],
 )
 
+cc_library(
+    name = "tox_attributes",
+    hdrs = ["tox_attributes.h"],
+    visibility = ["//c-toxcore:__subpackages__"],
+)
+
 cc_library(
     name = "ccompat",
     srcs = ["ccompat.c"],
@@ -47,6 +53,59 @@ cc_library(
     deps = [":attributes"],
 )
 
+cc_library(
+    name = "tox_memory",
+    srcs = ["tox_memory.c"],
+    hdrs = [
+        "tox_memory.h",
+        "tox_memory_impl.h",
+    ],
+    visibility = ["//c-toxcore:__subpackages__"],
+    deps = [
+        ":ccompat",
+        ":tox_attributes",
+    ],
+)
+
+cc_library(
+    name = "os_memory",
+    srcs = ["os_memory.c"],
+    hdrs = ["os_memory.h"],
+    visibility = ["//c-toxcore:__subpackages__"],
+    deps = [
+        ":attributes",
+        ":tox_memory",
+    ],
+)
+
+cc_library(
+    name = "tox_random",
+    srcs = ["tox_random.c"],
+    hdrs = [
+        "tox_random.h",
+        "tox_random_impl.h",
+    ],
+    visibility = ["//c-toxcore:__subpackages__"],
+    deps = [
+        ":ccompat",
+        ":tox_attributes",
+        ":tox_memory",
+    ],
+)
+
+cc_library(
+    name = "os_random",
+    srcs = ["os_random.c"],
+    hdrs = ["os_random.h"],
+    visibility = ["//c-toxcore:__subpackages__"],
+    deps = [
+        ":attributes",
+        ":ccompat",
+        ":tox_random",
+        "@libsodium",
+    ],
+)
+
 cc_library(
     name = "mem",
     srcs = ["mem.c"],
@@ -55,6 +114,7 @@ cc_library(
     deps = [
         ":attributes",
         ":ccompat",
+        ":tox_memory",
     ],
 )
 
@@ -65,7 +125,9 @@ cc_library(
     hdrs = ["mem_test_util.hh"],
     deps = [
         ":mem",
+        ":os_memory",
         ":test_util",
+        ":tox_memory",
     ],
 )
 
@@ -75,6 +137,7 @@ cc_test(
     srcs = ["mem_test.cc"],
     deps = [
         ":mem",
+        ":os_memory",
         "@com_google_googletest//:gtest",
         "@com_google_googletest//:gtest_main",
     ],
@@ -208,6 +271,7 @@ cc_test(
         ":bin_unpack",
         ":logger",
         ":mem",
+        ":os_memory",
         "@com_google_googletest//:gtest",
         "@com_google_googletest//:gtest_main",
     ],
@@ -222,6 +286,7 @@ cc_library(
         ":attributes",
         ":ccompat",
         ":mem",
+        ":tox_random",
         ":util",
         "@libsodium",
     ],
@@ -249,6 +314,7 @@ cc_library(
     deps = [
         ":crypto_core",
         ":test_util",
+        ":tox_random",
     ],
 )
 
@@ -285,6 +351,7 @@ cc_test(
     deps = [
         ":list",
         ":mem",
+        ":os_memory",
         "@com_google_googletest//:gtest",
         "@com_google_googletest//:gtest_main",
     ],
@@ -1148,6 +1215,8 @@ cc_library(
         ":net_profile",
         ":network",
         ":onion_client",
+        ":os_memory",
+        ":os_random",
         ":state",
         ":tox_log_level",
         ":tox_options",
@@ -1163,6 +1232,7 @@ cc_test(
     srcs = ["tox_test.cc"],
     deps = [
         ":crypto_core",
+        ":os_random",
         ":tox",
         ":tox_log_level",
         ":tox_options",
diff --git a/toxcore/Makefile.inc b/toxcore/Makefile.inc
index de9227b6d..a44a65fe3 100644
--- a/toxcore/Makefile.inc
+++ b/toxcore/Makefile.inc
@@ -110,6 +110,10 @@ libtoxcore_la_SOURCES = ../third_party/cmp/cmp.c \
                         ../toxcore/onion_client.h \
                         ../toxcore/onion.c \
                         ../toxcore/onion.h \
+                        ../toxcore/os_memory.c \
+                        ../toxcore/os_memory.h \
+                        ../toxcore/os_random.c \
+                        ../toxcore/os_random.h \
                         ../toxcore/ping_array.c \
                         ../toxcore/ping_array.h \
                         ../toxcore/ping.c \
@@ -131,6 +135,7 @@ libtoxcore_la_SOURCES = ../third_party/cmp/cmp.c \
                         ../toxcore/timed_auth.c \
                         ../toxcore/timed_auth.h \
                         ../toxcore/tox_api.c \
+                        ../toxcore/tox_attributes.h \
                         ../toxcore/tox_dispatch.c \
                         ../toxcore/tox_dispatch.h \
                         ../toxcore/tox_event.c \
@@ -139,12 +144,18 @@ libtoxcore_la_SOURCES = ../third_party/cmp/cmp.c \
                         ../toxcore/tox_events.h \
                         ../toxcore/tox_log_level.c \
                         ../toxcore/tox_log_level.h \
+                        ../toxcore/tox_memory.c \
+                        ../toxcore/tox_memory.h \
+                        ../toxcore/tox_memory_impl.h \
                         ../toxcore/tox_options.c \
                         ../toxcore/tox_options.h \
                         ../toxcore/tox_pack.c \
                         ../toxcore/tox_pack.h \
                         ../toxcore/tox_private.c \
                         ../toxcore/tox_private.h \
+                        ../toxcore/tox_random.c \
+                        ../toxcore/tox_random.h \
+                        ../toxcore/tox_random_impl.h \
                         ../toxcore/tox_struct.h \
                         ../toxcore/tox_unpack.c \
                         ../toxcore/tox_unpack.h \
diff --git a/toxcore/bin_pack_test.cc b/toxcore/bin_pack_test.cc
index c46719c3a..b17cfa80c 100644
--- a/toxcore/bin_pack_test.cc
+++ b/toxcore/bin_pack_test.cc
@@ -7,6 +7,7 @@
 #include "bin_unpack.h"
 #include "logger.h"
 #include "mem.h"
+#include "os_memory.h"
 
 namespace {
 
diff --git a/toxcore/crypto_core.c b/toxcore/crypto_core.c
index 9f140aca1..49019c918 100644
--- a/toxcore/crypto_core.c
+++ b/toxcore/crypto_core.c
@@ -13,6 +13,7 @@
 #include "attributes.h"
 #include "ccompat.h"
 #include "mem.h"
+#include "tox_random.h"
 #include "util.h"
 
 static_assert(CRYPTO_PUBLIC_KEY_SIZE == crypto_box_PUBLICKEYBYTES,
@@ -204,7 +205,7 @@ uint64_t random_u64(const Random *rng)
 
 uint32_t random_range_u32(const Random *rng, uint32_t upper_bound)
 {
-    return rng->funcs->random_uniform(rng->obj, upper_bound);
+    return tox_random_uniform(rng, upper_bound);
 }
 
 bool crypto_signature_create(uint8_t signature[CRYPTO_SIGNATURE_SIZE],
@@ -493,39 +494,7 @@ void crypto_sha512(uint8_t hash[CRYPTO_SHA512_SIZE], const uint8_t *data, size_t
 #endif /* FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
 }
 
-static void sys_random_bytes(void *_Nonnull obj, uint8_t *_Nonnull bytes, size_t length)
-{
-    randombytes(bytes, length);
-}
-
-static uint32_t sys_random_uniform(void *_Nonnull obj, uint32_t upper_bound)
-{
-    return randombytes_uniform(upper_bound);
-}
-
-static const Random_Funcs os_random_funcs = {
-    sys_random_bytes,
-    sys_random_uniform,
-};
-
-static const Random os_random_obj = {&os_random_funcs};
-
-const Random *os_random(void)
-{
-#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
-    if ((true)) {
-        return nullptr;
-    }
-#endif /* FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
-    // It is safe to call this function more than once and from different
-    // threads -- subsequent calls won't have any effects.
-    if (sodium_init() == -1) {
-        return nullptr;
-    }
-    return &os_random_obj;
-}
-
 void random_bytes(const Random *rng, uint8_t *bytes, size_t length)
 {
-    rng->funcs->random_bytes(rng->obj, bytes, length);
+    tox_random_bytes(rng, bytes, length);
 }
diff --git a/toxcore/crypto_core.h b/toxcore/crypto_core.h
index 82b31e393..99b976ae1 100644
--- a/toxcore/crypto_core.h
+++ b/toxcore/crypto_core.h
@@ -17,6 +17,7 @@
 
 #include "attributes.h"
 #include "mem.h"
+#include "tox_random.h"
 
 #ifdef __cplusplus
 extern "C" {
@@ -78,44 +79,6 @@ extern "C" {
  */
 #define CRYPTO_SHA512_SIZE             64
 
-/** @brief Fill a byte array with random bytes.
- *
- * This is the key generator callback and as such must be a cryptographically
- * secure pseudo-random number generator (CSPRNG). The security of Tox heavily
- * depends on the security of this RNG.
- */
-typedef void crypto_random_bytes_cb(void *_Nullable obj, uint8_t *_Nonnull bytes, size_t length);
-
-/** @brief Generate a random integer between 0 and @p upper_bound.
- *
- * Should produce a uniform random distribution, but Tox security does not
- * depend on this being correct. In principle, it could even be a non-CSPRNG.
- */
-typedef uint32_t crypto_random_uniform_cb(void *_Nullable obj, uint32_t upper_bound);
-
-/** @brief Virtual function table for Random. */
-typedef struct Random_Funcs {
-    crypto_random_bytes_cb *_Nullable random_bytes;
-    crypto_random_uniform_cb *_Nullable random_uniform;
-} Random_Funcs;
-
-/** @brief Random number generator object.
- *
- * Can be used by test code and fuzzers to make toxcore behave in specific
- * well-defined (non-random) ways. Production code ought to use libsodium's
- * CSPRNG and use `os_random` below.
- */
-typedef struct Random {
-    const Random_Funcs *_Nullable funcs;
-    void *_Nullable obj;
-} Random;
-
-/** @brief System random number generator.
- *
- * Uses libsodium's CSPRNG (on Linux, `/dev/urandom`).
- */
-const Random *_Nullable os_random(void);
-
 /**
  * @brief The number of bytes in an encryption public key used by DHT group chats.
  */
@@ -227,6 +190,11 @@ bool crypto_sha512_eq(const uint8_t cksum1[_Nonnull CRYPTO_SHA512_SIZE], const u
  */
 bool crypto_sha256_eq(const uint8_t cksum1[_Nonnull CRYPTO_SHA256_SIZE], const uint8_t cksum2[_Nonnull CRYPTO_SHA256_SIZE]);
 
+/**
+ * @brief Shorter internal name for the RNG type.
+ */
+typedef Tox_Random Random;
+
 /**
  * @brief Return a random 8 bit integer.
  */
diff --git a/toxcore/crypto_core_test_util.cc b/toxcore/crypto_core_test_util.cc
index b48871a53..19d8ff949 100644
--- a/toxcore/crypto_core_test_util.cc
+++ b/toxcore/crypto_core_test_util.cc
@@ -5,15 +5,16 @@
 
 #include "crypto_core.h"
 #include "test_util.hh"
+#include "tox_random_impl.h"
 
-Random_Funcs const Random_Class::vtable = {
-    Method<crypto_random_bytes_cb, Random_Class>::invoke<&Random_Class::random_bytes>,
-    Method<crypto_random_uniform_cb, Random_Class>::invoke<&Random_Class::random_uniform>,
+Tox_Random_Funcs const Random_Class::vtable = {
+    Method<tox_random_bytes_cb, Random_Class>::invoke<&Random_Class::random_bytes>,
+    Method<tox_random_uniform_cb, Random_Class>::invoke<&Random_Class::random_uniform>,
 };
 
 Random_Class::~Random_Class() = default;
 
-void Test_Random::random_bytes(void *obj, uint8_t *bytes, size_t length)
+void Test_Random::random_bytes(void *obj, uint8_t *bytes, uint32_t length)
 {
     std::generate(bytes, &bytes[length], std::ref(lcg));
 }
diff --git a/toxcore/crypto_core_test_util.hh b/toxcore/crypto_core_test_util.hh
index 91a9d68ee..53b9b07d1 100644
--- a/toxcore/crypto_core_test_util.hh
+++ b/toxcore/crypto_core_test_util.hh
@@ -8,12 +8,13 @@
 
 #include "crypto_core.h"
 #include "test_util.hh"
+#include "tox_random_impl.h"
 
 struct Random_Class {
-    static Random_Funcs const vtable;
-    Random const self;
+    static Tox_Random_Funcs const vtable;
+    Tox_Random const self;
 
-    operator Random const *() const { return &self; }
+    operator Tox_Random const *() const { return &self; }
 
     Random_Class(Random_Class const &) = default;
     Random_Class()
@@ -22,8 +23,8 @@ struct Random_Class {
     }
 
     virtual ~Random_Class();
-    virtual crypto_random_bytes_cb random_bytes = 0;
-    virtual crypto_random_uniform_cb random_uniform = 0;
+    virtual tox_random_bytes_cb random_bytes = 0;
+    virtual tox_random_uniform_cb random_uniform = 0;
 };
 
 /**
@@ -35,7 +36,7 @@ struct Random_Class {
 class Test_Random : public Random_Class {
     std::minstd_rand lcg;
 
-    void random_bytes(void *obj, uint8_t *bytes, size_t length) override;
+    void random_bytes(void *obj, uint8_t *bytes, uint32_t length) override;
     uint32_t random_uniform(void *obj, uint32_t upper_bound) override;
 };
 
@@ -83,6 +84,6 @@ inline bool operator==(PublicKey::Base const &pk1, PublicKey const &pk2)
 
 std::ostream &operator<<(std::ostream &out, PublicKey const &pk);
 
-PublicKey random_pk(const Random *rng);
+PublicKey random_pk(const Tox_Random *rng);
 
 #endif  // C_TOXCORE_TOXCORE_CRYPTO_CORE_TEST_UTIL_H
diff --git a/toxcore/events/events_alloc.h b/toxcore/events/events_alloc.h
index ce0518380..b131002de 100644
--- a/toxcore/events/events_alloc.h
+++ b/toxcore/events/events_alloc.h
@@ -6,7 +6,6 @@
 #define C_TOXCORE_TOXCORE_EVENTS_EVENTS_ALLOC_H
 
 #include "../attributes.h"
-#include "../mem.h"
 #include "../tox.h"
 #include "../tox_events.h"
 #include "../tox_private.h"
@@ -15,17 +14,19 @@
 extern "C" {
 #endif
 
+struct Tox_Memory;
+
 struct Tox_Events {
     Tox_Event *_Nonnull events;
     uint32_t events_size;
     uint32_t events_capacity;
 
-    const Memory *_Nonnull mem;
+    const struct Tox_Memory *_Nonnull mem;
 };
 
 typedef struct Tox_Events_State {
     Tox_Err_Events_Iterate error;
-    const Memory *_Nonnull mem;
+    const struct Tox_Memory *_Nonnull mem;
     Tox_Events *_Nonnull events;
 } Tox_Events_State;
 
diff --git a/toxcore/list_test.cc b/toxcore/list_test.cc
index 794c5e233..7cf3efe1b 100644
--- a/toxcore/list_test.cc
+++ b/toxcore/list_test.cc
@@ -3,6 +3,7 @@
 #include <gtest/gtest.h>
 
 #include "mem.h"
+#include "os_memory.h"
 
 namespace {
 
diff --git a/toxcore/mem.c b/toxcore/mem.c
index 31aa4c9e5..ce33fb4a0 100644
--- a/toxcore/mem.c
+++ b/toxcore/mem.c
@@ -5,59 +5,29 @@
 
 #include "mem.h"
 
-#include <stdlib.h>
+#include <string.h>
 
-#include "attributes.h"
 #include "ccompat.h"
-
-static void *sys_malloc(void *_Nullable obj, uint32_t size)
-{
-    return malloc(size);
-}
-
-static void *sys_calloc(void *_Nullable obj, uint32_t nmemb, uint32_t size)
-{
-    return calloc(nmemb, size);
-}
-
-static void *sys_realloc(void *_Nullable obj, void *_Nullable ptr, uint32_t size)
-{
-    return realloc(ptr, size);
-}
-
-static void sys_free(void *_Nullable obj, void *_Nullable ptr)
-{
-    free(ptr);
-}
-
-static const Memory_Funcs os_memory_funcs = {
-    sys_malloc,
-    sys_calloc,
-    sys_realloc,
-    sys_free,
-};
-static const Memory os_memory_obj = {&os_memory_funcs};
-
-const Memory *os_memory(void)
-{
-    return &os_memory_obj;
-}
+#include "tox_memory.h"
 
 void *mem_balloc(const Memory *mem, uint32_t size)
 {
-    void *const ptr = mem->funcs->malloc(mem->obj, size);
+    void *const ptr = tox_memory_malloc(mem, size);
     return ptr;
 }
 
 void *mem_brealloc(const Memory *mem, void *ptr, uint32_t size)
 {
-    void *const new_ptr = mem->funcs->realloc(mem->obj, ptr, size);
+    void *const new_ptr = tox_memory_realloc(mem, ptr, size);
     return new_ptr;
 }
 
 void *mem_alloc(const Memory *mem, uint32_t size)
 {
-    void *const ptr = mem->funcs->calloc(mem->obj, 1, size);
+    void *const ptr = tox_memory_malloc(mem, size);
+    if (ptr != nullptr) {
+        memset(ptr, 0, size);
+    }
     return ptr;
 }
 
@@ -69,7 +39,10 @@ void *mem_valloc(const Memory *mem, uint32_t nmemb, uint32_t size)
         return nullptr;
     }
 
-    void *const ptr = mem->funcs->calloc(mem->obj, nmemb, size);
+    void *const ptr = tox_memory_malloc(mem, bytes);
+    if (ptr != nullptr) {
+        memset(ptr, 0, bytes);
+    }
     return ptr;
 }
 
@@ -81,11 +54,11 @@ void *mem_vrealloc(const Memory *mem, void *ptr, uint32_t nmemb, uint32_t size)
         return nullptr;
     }
 
-    void *const new_ptr = mem->funcs->realloc(mem->obj, ptr, bytes);
+    void *const new_ptr = tox_memory_realloc(mem, ptr, bytes);
     return new_ptr;
 }
 
 void mem_delete(const Memory *mem, void *ptr)
 {
-    mem->funcs->free(mem->obj, ptr);
+    tox_memory_dealloc(mem, ptr);
 }
diff --git a/toxcore/mem.h b/toxcore/mem.h
index a8a4eff99..6784525bd 100644
--- a/toxcore/mem.h
+++ b/toxcore/mem.h
@@ -12,30 +12,13 @@
 #include <stdint.h>     // uint*_t
 
 #include "attributes.h"
+#include "tox_memory.h"
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 
-typedef void *mem_malloc_cb(void *_Nullable obj, uint32_t size);
-typedef void *mem_calloc_cb(void *_Nullable obj, uint32_t nmemb, uint32_t size);
-typedef void *mem_realloc_cb(void *_Nullable obj, void *_Nullable ptr, uint32_t size);
-typedef void mem_free_cb(void *_Nullable obj, void *_Nullable ptr);
-
-/** @brief Functions wrapping standard C memory allocation functions. */
-typedef struct Memory_Funcs {
-    mem_malloc_cb *_Nullable malloc;
-    mem_calloc_cb *_Nullable calloc;
-    mem_realloc_cb *_Nullable realloc;
-    mem_free_cb *_Nullable free;
-} Memory_Funcs;
-
-typedef struct Memory {
-    const Memory_Funcs *_Nullable funcs;
-    void *_Nullable obj;
-} Memory;
-
-const Memory *_Nullable os_memory(void);
+typedef Tox_Memory Memory;
 
 /**
  * @brief Allocate an array of a given size for built-in types.
diff --git a/toxcore/mem_test.cc b/toxcore/mem_test.cc
index 5b649e211..c0e88831b 100644
--- a/toxcore/mem_test.cc
+++ b/toxcore/mem_test.cc
@@ -2,6 +2,8 @@
 
 #include <gtest/gtest.h>
 
+#include "os_memory.h"
+
 namespace {
 
 TEST(Mem, AllocLarge)
diff --git a/toxcore/mem_test_util.cc b/toxcore/mem_test_util.cc
index 02ade8fc6..e62887103 100644
--- a/toxcore/mem_test_util.cc
+++ b/toxcore/mem_test_util.cc
@@ -2,28 +2,28 @@
 
 #include <cstdlib>
 
-#include "mem.h"
 #include "test_util.hh"
+#include "tox_memory_impl.h"
 
-Memory_Funcs const Memory_Class::vtable = {
-    Method<mem_malloc_cb, Memory_Class>::invoke<&Memory_Class::malloc>,
-    Method<mem_calloc_cb, Memory_Class>::invoke<&Memory_Class::calloc>,
-    Method<mem_realloc_cb, Memory_Class>::invoke<&Memory_Class::realloc>,
-    Method<mem_free_cb, Memory_Class>::invoke<&Memory_Class::free>,
+Tox_Memory_Funcs const Memory_Class::vtable = {
+    Method<tox_memory_malloc_cb, Memory_Class>::invoke<&Memory_Class::malloc>,
+    Method<tox_memory_realloc_cb, Memory_Class>::invoke<&Memory_Class::realloc>,
+    Method<tox_memory_dealloc_cb, Memory_Class>::invoke<&Memory_Class::dealloc>,
 };
 
 Memory_Class::~Memory_Class() = default;
 
-void *Test_Memory::malloc(void *obj, uint32_t size) { return mem->funcs->malloc(mem->obj, size); }
-
-void *Test_Memory::calloc(void *obj, uint32_t nmemb, uint32_t size)
+void *Test_Memory::malloc(void *obj, uint32_t size)
 {
-    return mem->funcs->calloc(mem->obj, nmemb, size);
+    return mem->funcs->malloc_callback(mem->user_data, size);
 }
 
 void *Test_Memory::realloc(void *obj, void *ptr, uint32_t size)
 {
-    return mem->funcs->realloc(mem->obj, ptr, size);
+    return mem->funcs->realloc_callback(mem->user_data, ptr, size);
 }
 
-void Test_Memory::free(void *obj, void *ptr) { return mem->funcs->free(mem->obj, ptr); }
+void Test_Memory::dealloc(void *obj, void *ptr)
+{
+    return mem->funcs->dealloc_callback(mem->user_data, ptr);
+}
diff --git a/toxcore/mem_test_util.hh b/toxcore/mem_test_util.hh
index 03094eb57..7a02a22e3 100644
--- a/toxcore/mem_test_util.hh
+++ b/toxcore/mem_test_util.hh
@@ -2,13 +2,15 @@
 #define C_TOXCORE_TOXCORE_MEM_TEST_UTIL_H
 
 #include "mem.h"
+#include "os_memory.h"
 #include "test_util.hh"
+#include "tox_memory_impl.h"
 
 struct Memory_Class {
-    static Memory_Funcs const vtable;
-    Memory const self;
+    static Tox_Memory_Funcs const vtable;
+    Tox_Memory const self;
 
-    operator Memory const *() const { return &self; }
+    operator Tox_Memory const *() const { return &self; }
 
     Memory_Class(Memory_Class const &) = default;
     Memory_Class()
@@ -17,10 +19,9 @@ struct Memory_Class {
     }
 
     virtual ~Memory_Class();
-    virtual mem_malloc_cb malloc = 0;
-    virtual mem_calloc_cb calloc = 0;
-    virtual mem_realloc_cb realloc = 0;
-    virtual mem_free_cb free = 0;
+    virtual tox_memory_malloc_cb malloc = 0;
+    virtual tox_memory_realloc_cb realloc = 0;
+    virtual tox_memory_dealloc_cb dealloc = 0;
 };
 
 /**
@@ -28,12 +29,11 @@ struct Memory_Class {
  * subclassed to override individual (or all) functions.
  */
 class Test_Memory : public Memory_Class {
-    const Memory *mem = REQUIRE_NOT_NULL(os_memory());
+    const Tox_Memory *mem = REQUIRE_NOT_NULL(os_memory());
 
     void *malloc(void *obj, uint32_t size) override;
-    void *calloc(void *obj, uint32_t nmemb, uint32_t size) override;
     void *realloc(void *obj, void *ptr, uint32_t size) override;
-    void free(void *obj, void *ptr) override;
+    void dealloc(void *obj, void *ptr) override;
 };
 
 #endif  // C_TOXCORE_TOXCORE_MEM_TEST_UTIL_H
diff --git a/toxcore/os_memory.c b/toxcore/os_memory.c
new file mode 100644
index 000000000..7275a45bc
--- /dev/null
+++ b/toxcore/os_memory.c
@@ -0,0 +1,40 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2022-2025 The TokTok team.
+ */
+#include "os_memory.h"
+
+#include <stdlib.h>
+
+#include "attributes.h"
+#include "tox_memory.h"
+#include "tox_memory_impl.h" // IWYU pragma: keep
+
+static void *os_malloc(void *_Nonnull self, uint32_t size)
+{
+    // cppcheck-suppress misra-c2012-21.3
+    return malloc(size);
+}
+
+static void *os_realloc(void *_Nonnull self, void *_Nullable ptr, uint32_t size)
+{
+    // cppcheck-suppress misra-c2012-21.3
+    return realloc(ptr, size);
+}
+
+static void os_dealloc(void *_Nonnull self, void *_Nullable ptr)
+{
+    // cppcheck-suppress misra-c2012-21.3
+    free(ptr);
+}
+
+static const Tox_Memory_Funcs os_memory_funcs = {
+    os_malloc,
+    os_realloc,
+    os_dealloc,
+};
+const Tox_Memory os_memory_obj = {&os_memory_funcs};
+
+const Tox_Memory *os_memory(void)
+{
+    return &os_memory_obj;
+}
diff --git a/toxcore/os_memory.h b/toxcore/os_memory.h
new file mode 100644
index 000000000..cfbe6a2c7
--- /dev/null
+++ b/toxcore/os_memory.h
@@ -0,0 +1,22 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2022-2025 The TokTok team.
+ */
+
+#ifndef C_TOXCORE_TOXCORE_OS_MEMORY_H
+#define C_TOXCORE_TOXCORE_OS_MEMORY_H
+
+#include "tox_memory.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern const Tox_Memory os_memory_obj;
+
+const Tox_Memory *os_memory(void);
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
+
+#endif /* C_TOXCORE_TOXCORE_OS_MEMORY_H */
diff --git a/toxcore/os_random.c b/toxcore/os_random.c
new file mode 100644
index 000000000..ee71ce30b
--- /dev/null
+++ b/toxcore/os_random.c
@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2022-2025 The TokTok team.
+ */
+#include "os_random.h"
+
+#include <sodium.h>
+
+#include "attributes.h"
+#include "ccompat.h"
+#include "tox_random.h"
+#include "tox_random_impl.h"
+
+static void os_random_bytes(void *_Nonnull self, uint8_t *_Nonnull bytes, uint32_t length)
+{
+    randombytes(bytes, length);
+}
+
+static uint32_t os_random_uniform(void *_Nonnull self, uint32_t upper_bound)
+{
+    return randombytes_uniform(upper_bound);
+}
+
+static const Tox_Random_Funcs os_random_funcs = {
+    os_random_bytes,
+    os_random_uniform,
+};
+
+const Tox_Random os_random_obj = {&os_random_funcs};
+
+const Tox_Random *os_random(void)
+{
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+    if ((true)) {
+        return nullptr;
+    }
+#endif /* FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION */
+    // It is safe to call this function more than once and from different
+    // threads -- subsequent calls won't have any effects.
+    if (sodium_init() == -1) {
+        return nullptr;
+    }
+    return &os_random_obj;
+}
diff --git a/toxcore/os_random.h b/toxcore/os_random.h
new file mode 100644
index 000000000..a670b8eeb
--- /dev/null
+++ b/toxcore/os_random.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2022-2025 The TokTok team.
+ */
+
+#ifndef C_TOXCORE_TOXCORE_OS_RANDOM_H
+#define C_TOXCORE_TOXCORE_OS_RANDOM_H
+
+#include "tox_random.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern const Tox_Random os_random_obj;
+
+/** @brief System random number generator.
+ *
+ * Uses libsodium's CSPRNG (on Linux, `/dev/urandom`).
+ */
+const Tox_Random *os_random(void);
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
+
+#endif /* C_TOXCORE_TOXCORE_OS_RANDOM_H */
diff --git a/toxcore/sort_test_util.hh b/toxcore/sort_test_util.hh
index 52b2aeb54..3e8a2c838 100644
--- a/toxcore/sort_test_util.hh
+++ b/toxcore/sort_test_util.hh
@@ -9,7 +9,7 @@
 
 #include "sort.h"
 
-struct Memory;
+struct Tox_Memory;
 
 template <typename T>
 constexpr Sort_Funcs sort_funcs()
@@ -41,7 +41,7 @@ constexpr Sort_Funcs sort_funcs()
 
 // A realistic test case where we have a struct with some stuff and an expensive value we compare.
 struct Some_Type {
-    const Memory *mem;
+    const Tox_Memory *mem;
     std::array<uint32_t, 8> compare_value;
     const char *name;
 
diff --git a/toxcore/tox_attributes.h b/toxcore/tox_attributes.h
new file mode 100644
index 000000000..fa646db0c
--- /dev/null
+++ b/toxcore/tox_attributes.h
@@ -0,0 +1,31 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2022-2025 The TokTok team.
+ */
+
+/**
+ * nonnull attributes for GCC/Clang and Cimple.
+ *
+ * This file is a modified version of c-toxcore/toxcore/attributes.h with a
+ * `tox_` prefix added to the macros to avoid conflicts with client code.
+ */
+#ifndef C_TOXCORE_TOXCORE_TOX_ATTRIBUTES_H
+#define C_TOXCORE_TOXCORE_TOX_ATTRIBUTES_H
+
+/* No declarations here. */
+
+//!TOKSTYLE-
+
+#ifndef __clang__
+#define _Nonnull
+#define _Nullable
+#endif
+
+#ifdef SPARSE
+#define tox_bitwise __attribute__((bitwise))
+#else
+#define tox_bitwise
+#endif
+
+//!TOKSTYLE+
+
+#endif /* C_TOXCORE_TOXCORE_TOX_ATTRIBUTES_H */
diff --git a/toxcore/tox_memory.c b/toxcore/tox_memory.c
new file mode 100644
index 000000000..a2d6ad8a8
--- /dev/null
+++ b/toxcore/tox_memory.c
@@ -0,0 +1,60 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2016-2025 The TokTok team.
+ * Copyright © 2013 Tox project.
+ */
+#include "tox_memory.h"
+
+#include <string.h>
+
+#include "ccompat.h"
+#include "tox_memory_impl.h"  // IWYU pragma: keep
+
+Tox_Memory *tox_memory_new(const Tox_Memory_Funcs *funcs, void *user_data)
+{
+    const Tox_Memory bootstrap = {funcs, user_data};
+
+    Tox_Memory *mem = (Tox_Memory *)tox_memory_alloc(&bootstrap, sizeof(Tox_Memory));
+
+    if (mem == nullptr) {
+        return nullptr;
+    }
+
+    *mem = bootstrap;
+
+    return mem;
+}
+
+void tox_memory_free(Tox_Memory *mem)
+{
+    if (mem == nullptr) {
+        return;
+    }
+
+    tox_memory_dealloc(mem, mem);
+}
+
+void *tox_memory_malloc(const Tox_Memory *mem, uint32_t size)
+{
+    void *const ptr = mem->funcs->malloc_callback(mem->user_data, size);
+    return ptr;
+}
+
+void *tox_memory_alloc(const Tox_Memory *mem, uint32_t size)
+{
+    void *const ptr = tox_memory_malloc(mem, size);
+    if (ptr != nullptr) {
+        memset(ptr, 0, size);
+    }
+    return ptr;
+}
+
+void *tox_memory_realloc(const Tox_Memory *mem, void *ptr, uint32_t size)
+{
+    void *const new_ptr = mem->funcs->realloc_callback(mem->user_data, ptr, size);
+    return new_ptr;
+}
+
+void tox_memory_dealloc(const Tox_Memory *mem, void *ptr)
+{
+    mem->funcs->dealloc_callback(mem->user_data, ptr);
+}
diff --git a/toxcore/tox_memory.h b/toxcore/tox_memory.h
new file mode 100644
index 000000000..c872bf4da
--- /dev/null
+++ b/toxcore/tox_memory.h
@@ -0,0 +1,75 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2016-2025 The TokTok team.
+ * Copyright © 2013 Tox project.
+ */
+
+/**
+ * Memory allocation and deallocation functions.
+ */
+#ifndef C_TOXCORE_TOXCORE_TOX_MEMORY_H
+#define C_TOXCORE_TOXCORE_TOX_MEMORY_H
+
+#include <stdint.h>     // uint*_t
+
+#include "tox_attributes.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** @brief Functions wrapping standard C memory allocation functions. */
+typedef struct Tox_Memory_Funcs Tox_Memory_Funcs;
+
+/**
+ * @brief A dynamic memory allocator.
+ */
+typedef struct Tox_Memory Tox_Memory;
+
+/**
+ * @brief Allocates a new allocator using itself to allocate its own memory.
+ *
+ * The passed `user_data` is stored and passed to allocator callbacks. It must
+ * outlive the `Tox_Memory` object, since it may be used by the callback invoked
+ * in `tox_memory_free`.
+ *
+ * @return NULL if allocation fails.
+ */
+Tox_Memory *_Nullable tox_memory_new(const Tox_Memory_Funcs *_Nonnull funcs, void *_Nullable user_data);
+
+/**
+ * @brief Destroys the allocator using its own deallocation function.
+ *
+ * The stored `user_data` will not be deallocated.
+ */
+void tox_memory_free(Tox_Memory *_Nullable mem);
+
+/**
+ * @brief Allocate an array of a given size for built-in types.
+ *
+ * The array will not be initialised. Supported built-in types are
+ * `uint8_t`, `int8_t`, and `int16_t`.
+ */
+void *_Nullable tox_memory_malloc(const Tox_Memory *_Nonnull mem, uint32_t size);
+
+/**
+ * @brief Allocate a single zero-initialised object.
+ *
+ * Always use as `(T *)tox_memory_alloc(mem, sizeof(T))`. Unlike `calloc`, this
+ * does not support allocating arrays. Use `malloc` and `memset` for that.
+ *
+ * @param mem The memory allocator.
+ * @param size Size in bytes of each element.
+ */
+void *_Nullable tox_memory_alloc(const Tox_Memory *_Nonnull mem, uint32_t size);
+
+/** @brief Resize a memory chunk vector. */
+void *_Nullable tox_memory_realloc(const Tox_Memory *_Nonnull mem, void *_Nullable ptr, uint32_t size);
+
+/** @brief Free an array, object, or object vector. */
+void tox_memory_dealloc(const Tox_Memory *_Nonnull mem, void *_Nullable ptr);
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
+
+#endif  /* C_TOXCORE_TOXCORE_TOX_MEMORY_H */
diff --git a/toxcore/tox_memory_impl.h b/toxcore/tox_memory_impl.h
new file mode 100644
index 000000000..789c57f95
--- /dev/null
+++ b/toxcore/tox_memory_impl.h
@@ -0,0 +1,49 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2016-2025 The TokTok team.
+ * Copyright © 2013 Tox project.
+ */
+
+/**
+ * Datatypes, functions and includes for the core networking.
+ */
+#ifndef C_TOXCORE_TOXCORE_TOX_MEMORY_IMPL_H
+#define C_TOXCORE_TOXCORE_TOX_MEMORY_IMPL_H
+
+#include <stdint.h>     // uint*_t
+
+#include "tox_memory.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** @brief Allocate a byte array, similar to malloc. */
+typedef void *tox_memory_malloc_cb(void *self, uint32_t size);
+/** @brief Reallocate a byte array, similar to realloc. */
+typedef void *tox_memory_realloc_cb(void *self, void *ptr, uint32_t size);
+/**
+ * @brief Deallocate a byte or object array, similar to free.
+ *
+ * Note that `tox_memory_free` will use this callback to deallocate itself, so
+ * once the deallocation is done, the allocator data structures can no longer be
+ * referenced.
+ */
+typedef void tox_memory_dealloc_cb(void *self, void *ptr);
+
+/** @brief Functions wrapping standard C memory allocation functions. */
+struct Tox_Memory_Funcs {
+    tox_memory_malloc_cb *malloc_callback;
+    tox_memory_realloc_cb *realloc_callback;
+    tox_memory_dealloc_cb *dealloc_callback;
+};
+
+struct Tox_Memory {
+    const Tox_Memory_Funcs *funcs;
+    void *user_data;
+};
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
+
+#endif  /* C_TOXCORE_TOXCORE_TOX_MEMORY_IMPL_H */
diff --git a/toxcore/tox_private.c b/toxcore/tox_private.c
index e87072e5c..12aabc87e 100644
--- a/toxcore/tox_private.c
+++ b/toxcore/tox_private.c
@@ -22,6 +22,8 @@
 #include "net_crypto.h"
 #include "net_profile.h"
 #include "network.h"
+#include "os_memory.h"
+#include "os_random.h"
 #include "tox.h"
 #include "tox_struct.h"  // IWYU pragma: keep
 
diff --git a/toxcore/tox_private.h b/toxcore/tox_private.h
index 4cc3edd00..89a292eff 100644
--- a/toxcore/tox_private.h
+++ b/toxcore/tox_private.h
@@ -22,9 +22,9 @@ typedef uint64_t tox_mono_time_cb(void *user_data);
 typedef struct Tox_System {
     tox_mono_time_cb *mono_time_callback;
     void *mono_time_user_data;
-    const struct Random *rng;
+    const struct Tox_Random *rng;
     const struct Network *ns;
-    const struct Memory *mem;
+    const struct Tox_Memory *mem;
 } Tox_System;
 
 Tox_System tox_default_system(void);
diff --git a/toxcore/tox_random.c b/toxcore/tox_random.c
new file mode 100644
index 000000000..8f1432d43
--- /dev/null
+++ b/toxcore/tox_random.c
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2022-2025 The TokTok team.
+ */
+#include "tox_random.h"
+
+#include "ccompat.h"
+#include "tox_memory.h"
+#include "tox_random_impl.h"
+
+Tox_Random *tox_random_new(const Tox_Random_Funcs *funcs, void *user_data, const Tox_Memory *mem)
+{
+    Tox_Random *rng = (Tox_Random *)tox_memory_alloc(mem, sizeof(Tox_Random));
+
+    if (rng == nullptr) {
+        return nullptr;
+    }
+
+    rng->funcs = funcs;
+    rng->user_data = user_data;
+
+    rng->mem = mem;
+
+    return rng;
+}
+
+void tox_random_free(Tox_Random *rng)
+{
+    if (rng == nullptr || rng->mem == nullptr) {
+        return;
+    }
+    tox_memory_dealloc(rng->mem, rng);
+}
+
+void tox_random_bytes(const Tox_Random *rng, uint8_t *bytes, uint32_t length)
+{
+    rng->funcs->bytes_callback(rng->user_data, bytes, length);
+}
+
+uint32_t tox_random_uniform(const Tox_Random *rng, uint32_t upper_bound)
+{
+    return rng->funcs->uniform_callback(rng->user_data, upper_bound);
+}
diff --git a/toxcore/tox_random.h b/toxcore/tox_random.h
new file mode 100644
index 000000000..3339a41cd
--- /dev/null
+++ b/toxcore/tox_random.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2022-2025 The TokTok team.
+ */
+
+#ifndef C_TOXCORE_TOXCORE_TOX_RANDOM_H
+#define C_TOXCORE_TOXCORE_TOX_RANDOM_H
+
+#include <stdbool.h>
+#include <stdint.h>
+
+#include "tox_attributes.h"
+#include "tox_memory.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct Tox_Random_Funcs Tox_Random_Funcs;
+
+typedef struct Tox_Random Tox_Random;
+
+Tox_Random *_Nullable tox_random_new(const Tox_Random_Funcs *_Nonnull funcs, void *_Nullable user_data, const Tox_Memory *_Nonnull mem);
+
+void tox_random_free(Tox_Random *_Nullable rng);
+
+void tox_random_bytes(const Tox_Random *_Nonnull rng, uint8_t *_Nonnull bytes, uint32_t length);
+uint32_t tox_random_uniform(const Tox_Random *_Nonnull rng, uint32_t upper_bound);
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
+
+#endif /* C_TOXCORE_TOXCORE_TOX_RANDOM_H */
diff --git a/toxcore/tox_random_impl.h b/toxcore/tox_random_impl.h
new file mode 100644
index 000000000..b7469015a
--- /dev/null
+++ b/toxcore/tox_random_impl.h
@@ -0,0 +1,53 @@
+/* SPDX-License-Identifier: GPL-3.0-or-later
+ * Copyright © 2022-2025 The TokTok team.
+ */
+
+#ifndef C_TOXCORE_TOXCORE_TOX_RANDOM_IMPL_H
+#define C_TOXCORE_TOXCORE_TOX_RANDOM_IMPL_H
+
+#include "tox_memory.h"
+#include "tox_random.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/** @brief Fill a byte array with random bytes.
+ *
+ * This is the key generator callback and as such must be a cryptographically
+ * secure pseudo-random number generator (CSPRNG). The security of Tox heavily
+ * depends on the security of this RNG.
+ */
+typedef void tox_random_bytes_cb(void *self, uint8_t *bytes, uint32_t length);
+
+/** @brief Generate a random integer between 0 and @p upper_bound.
+ *
+ * Should produce a uniform random distribution, but Tox security does not
+ * depend on this being correct. In principle, it could even be a non-CSPRNG.
+ */
+typedef uint32_t tox_random_uniform_cb(void *self, uint32_t upper_bound);
+
+/** @brief Virtual function table for Random. */
+struct Tox_Random_Funcs {
+    tox_random_bytes_cb *bytes_callback;
+    tox_random_uniform_cb *uniform_callback;
+};
+
+/** @brief Random number generator object.
+ *
+ * Can be used by test code and fuzzers to make toxcore behave in specific
+ * well-defined (non-random) ways. Production code ought to use libsodium's
+ * CSPRNG and use `os_random` below.
+ */
+struct Tox_Random {
+    const Tox_Random_Funcs *funcs;
+    void *user_data;
+
+    const Tox_Memory *mem;
+};
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
+
+#endif /* C_TOXCORE_TOXCORE_TOX_RANDOM_IMPL_H */
diff --git a/toxcore/tox_test.cc b/toxcore/tox_test.cc
index 6d3c25ca0..394829626 100644
--- a/toxcore/tox_test.cc
+++ b/toxcore/tox_test.cc
@@ -6,6 +6,7 @@
 #include <vector>
 
 #include "crypto_core.h"
+#include "os_random.h"
 #include "tox_log_level.h"
 #include "tox_options.h"
 #include "tox_private.h"
diff --git a/toxencryptsave/BUILD.bazel b/toxencryptsave/BUILD.bazel
index 917d9c007..b2c46a376 100644
--- a/toxencryptsave/BUILD.bazel
+++ b/toxencryptsave/BUILD.bazel
@@ -20,6 +20,8 @@ cc_library(
         ":defines",
         "//c-toxcore/toxcore:ccompat",
         "//c-toxcore/toxcore:crypto_core",
+        "//c-toxcore/toxcore:os_memory",
+        "//c-toxcore/toxcore:os_random",
         "@libsodium",
     ],
 )
@@ -34,6 +36,8 @@ cc_library(
     deps = [
         "//c-toxcore/toxcore:ccompat",
         "//c-toxcore/toxcore:crypto_core",
+        "//c-toxcore/toxcore:os_memory",
+        "//c-toxcore/toxcore:os_random",
         "@libsodium",
     ],
 )
diff --git a/toxencryptsave/toxencryptsave.c b/toxencryptsave/toxencryptsave.c
index 63bda8605..e34eb83d3 100644
--- a/toxencryptsave/toxencryptsave.c
+++ b/toxencryptsave/toxencryptsave.c
@@ -15,6 +15,9 @@
 
 #include "../toxcore/ccompat.h"
 #include "../toxcore/crypto_core.h"
+#include "../toxcore/mem.h"
+#include "../toxcore/os_memory.h"
+#include "../toxcore/os_random.h"
 #include "defines.h"
 
 static_assert(TOX_PASS_SALT_LENGTH == crypto_pwhash_scryptsalsa208sha256_SALTBYTES,
@@ -198,9 +201,10 @@ Tox_Pass_Key *tox_pass_key_derive_with_salt(
 bool tox_pass_key_encrypt(const Tox_Pass_Key *key, const uint8_t plaintext[], size_t plaintext_len,
                           uint8_t ciphertext[], Tox_Err_Encryption *error)
 {
+    const Memory *mem = os_memory();
     const Random *rng = os_random();
 
-    if (rng == nullptr) {
+    if (mem == nullptr || rng == nullptr) {
         SET_ERROR_PARAMETER(error, TOX_ERR_ENCRYPTION_FAILED);
         return false;
     }
@@ -231,7 +235,7 @@ bool tox_pass_key_encrypt(const Tox_Pass_Key *key, const uint8_t plaintext[], si
     ciphertext += crypto_box_NONCEBYTES;
 
     /* now encrypt */
-    const int32_t encrypted_len = encrypt_data_symmetric(os_memory(), key->key, nonce, plaintext, plaintext_len, ciphertext);
+    const int32_t encrypted_len = encrypt_data_symmetric(mem, key->key, nonce, plaintext, plaintext_len, ciphertext);
     if (encrypted_len < 0 || (size_t)encrypted_len != plaintext_len + crypto_box_MACBYTES) {
         SET_ERROR_PARAMETER(error, TOX_ERR_ENCRYPTION_FAILED);
         return false;
@@ -291,6 +295,13 @@ bool tox_pass_encrypt(const uint8_t plaintext[], size_t plaintext_len, const uin
 bool tox_pass_key_decrypt(const Tox_Pass_Key *key, const uint8_t ciphertext[], size_t ciphertext_len,
                           uint8_t plaintext[], Tox_Err_Decryption *error)
 {
+    const Memory *mem = os_memory();
+
+    if (mem == nullptr) {
+        SET_ERROR_PARAMETER(error, TOX_ERR_DECRYPTION_FAILED);
+        return false;
+    }
+
     if (ciphertext_len <= TOX_PASS_ENCRYPTION_EXTRA_LENGTH) {
         SET_ERROR_PARAMETER(error, TOX_ERR_DECRYPTION_INVALID_LENGTH);
         return false;
@@ -316,7 +327,7 @@ bool tox_pass_key_decrypt(const Tox_Pass_Key *key, const uint8_t ciphertext[], s
     ciphertext += crypto_box_NONCEBYTES;
 
     /* decrypt the ciphertext */
-    const int32_t decrypted_len = decrypt_data_symmetric(os_memory(), key->key, nonce, ciphertext, decrypt_length + crypto_box_MACBYTES, plaintext);
+    const int32_t decrypted_len = decrypt_data_symmetric(mem, key->key, nonce, ciphertext, decrypt_length + crypto_box_MACBYTES, plaintext);
     if (decrypted_len < 0 || (size_t)decrypted_len != decrypt_length) {
         SET_ERROR_PARAMETER(error, TOX_ERR_DECRYPTION_FAILED);
         return false;
diff --git a/toxencryptsave/toxencryptsave.h b/toxencryptsave/toxencryptsave.h
index f70ff8b4d..131bf6cb3 100644
--- a/toxencryptsave/toxencryptsave.h
+++ b/toxencryptsave/toxencryptsave.h
@@ -226,10 +226,7 @@ bool tox_pass_decrypt(const uint8_t ciphertext[], size_t ciphertext_len, const u
  * using tox_pass_key_derive or tox_pass_key_derive_with_salt and must be
  * deallocated using tox_pass_key_free.
  */
-#ifndef TOX_PASS_KEY_DEFINED
-#define TOX_PASS_KEY_DEFINED
 typedef struct Tox_Pass_Key Tox_Pass_Key;
-#endif /* TOX_PASS_KEY_DEFINED */
 
 /**
  * Deallocate a Tox_Pass_Key. This function behaves like `free()`, so NULL is an