Rust Accepted This Safe-Looking Code for 4,001 Days: Reproducing the Borrow-Checker Use-After-Free on Stable 1.99.0, Where the Fix Is 8 Lines and the Test-Suite Bill Is 38 Files

Wed, 14 Oct 2026 00:00:00 +0000

On 2026-10-13 at 08:45:54Z, an issue was filed against rust-lang/rust with the title “struct’s lifetime requirements can be bypassed via covariant field assignment”. Within fifteen minutes the type team had it labelled P-critical; by 09:25 it was P-high and marked I-unsound. A Hacker News submission the same morning reached 667 points and 373 comments. The issue number is #164250.

The reason a compiler bug of this kind attracts that much attention is not the bug. It is the code that triggers it. The reproducer contains no unsafe, no transmute, no raw pointers, and no FFI. It is the kind of struct-plus-Drop pairing that appears in ordinary Rust, and as of this writing every released rustc and every nightly accepts it.

Miri on SoloSoft

Rust Accepted This Safe-Looking Code for 4,001 Days: Reproducing the Borrow-Checker Use-After-Free on Stable 1.99.0, Where the Fix Is 8 Lines and the Test-Suite Bill Is 38 Files