Issue #164250 on rust-lang/rust reports that struct lifetime requirements can be bypassed via covariant field assignment, labeled I-unsound with priority P-high.
Reporter jsnell provided a minimal reproducer using a generic struct Q<T: ‘static + Send> where assigning a stack borrow to a covariant Option field inside Drop can promote it to ‘static, yielding stack-use-after-scope under ASan.
Rust maintainers noted the bug is about 11 years old (unsound since at least Rust 1.4 per further analysis). Priority was briefly P-critical then lowered to P-high because the pattern has not been hit accidentally in the wild; exploitation likely requires an intentionally malicious Drop implementation.
Related discussion covers array unification and swapping fields between struct instances with incompatible lifetime bounds in Drop callbacks. Miri on nightly reports undefined behavior for some reproducers.
Official note from @lcnr: Rust’s type system is intended to prevent memory unsafety; the Types Team is working on fixes as part of broader soundness efforts including Project Zero.