11 year old unsoundness bugs found in Rust borrow checker

A soundness hole was discovered in Rust where covariant field assignment and unification can bypass lifetime requirements, letting code place a non-'static reference into a slot that the type system believes to be &'static. Several minimal examples show a struct with an Option holding a reference, Drop implementations that treat that reference as 'static (for instance by pushing it into a global Vec<Box<dyn Any>> or spawning a thread that later prints it), and then assigning a local reference into the field before the local scope ends. The programs compile cleanly and may print or return data that has already gone out of scope; with ASan they exhibit stack-use-after-scope crashes. Variants demonstrate the same issue via field assignment, swapping, or closure callbacks, and at least some examples compile on recent nightlies and many older stable releases, with variants traced back to very early Rust versions.

The core fault is that lifetime bounds (e.g. T: 'static) are not reliably enforced during unification and covariant assignments, so the borrow checker and variance handling allow ill-formed but accepted values. The report labels this as a high-priority, unsound bug affecting the borrow checker, destructors (Drop), lifetimes and variance. Reproductions and concise test programs are provided that reliably show use-after-free behavior, making this a serious correctness and safety regression requiring types-team review and fixes.