RUSTSEC-2026-0284

Two independent soundness problems, both reachable from safe Rust.

`Map::into_iter` drops `builder` (the caller-supplied hasher `H`) and `incin` by hand, then commits the ownership transfer with `mem::forget(self)`. `H::drop` is user code and may panic. If it does, `mem::forget(self)` is skipped and the still-live `Map` unwinds, whose field drop glue destroys `builder` a second time. An empty map is enough — no entries or concurrency required.

`SharedIncin::clear` writes `mem::uninitialized::<Arc<_>>()` into `self.inner` before taking the real `Arc` out. `Arc` has a validity invariant, so this is undefined behaviour at the point of creation, with no panic or concurrency involved. Between that write and the repairing one, `self.inner` also holds garbage while `self` is still droppable, so an unwind from `incin.clear()` or `Arc::new` decrements a refcount through an uninitialized pointer. The `make_shared_incin!` macro is instantiated five times, so this covers `queue`, `stack`, `map`, `channel::spmc` and `channel::mpmc`.

## Impact

* CWE-415 (Double Free): the same allocation is freed twice. * CWE-416 (Use-After-Free): a freed allocation is accessed during a repeated `Drop`. * CWE-908 (Use of Uninitialized Resource): an `Arc` is constructed from uninitialized bytes.

## Fix

No fixed release is available. The crate has had no release since 2018-11-18 and the maintainer has not responded to the report.