Adding a trait bound can cause code to have UB.

I'm not sure if this is a bug or not.

This is a consequence of https://github.com/rust-lang/rust/issues/24066, and uses the same setup as https://github.com/rust-lang/rust/issues/146430

I tried this code:

use std::ops::DerefMut;
trait ToMut<'a> {
    type Assoc: DerefMut<Target = i32>;
}
impl<'a, T> ToMut<'a> for T {
    type Assoc = &'a mut i32;
}

fn main() {
    works::<()>(&mut 1);
    fails::<()>(&mut 1);
}


fn works<'a, T>(mut x: <T as ToMut<'a>>::Assoc) {
    unsafe {
        let y = &raw mut *x;
        let _z = &raw mut *x;
        *y = 2;
    }
}

fn fails<'a, T: ToMut<'a>>(mut x: <T as ToMut<'a>>::Assoc) {
    unsafe {
        let y = &raw mut *x;
        let _z = &raw mut *x;
        *y = 2;
    }
}

I expected works and fails to behave identically, since they differ only by a trait bound. However, according to Miri, works doesn't have UB, but fails has UB.

Miri output:

warning: variable does not need to be mutable
  --> src/main.rs:15:17
   |
15 | fn works<'a, T>(mut x: <T as ToMut<'a>>::Assoc) {
   |                 ----^
   |                 |
   |                 help: remove this `mut`
   |
   = note: `#[warn(unused_mut)]` (part of `#[warn(unused)]`) on by default

error: Undefined Behavior: attempting a write access using <310> at alloc158[0x0], but that tag does not exist in the borrow stack for this location
  --> src/main.rs:29:9
   |
29 |         *y = 2;
   |         ^^^^^^ this error occurs as part of an access at alloc158[0x0..0x4]
   |
   = help: this indicates a potential bug in the program: it performed an invalid operation, but the Stacked Borrows rules it violated are still experimental
   = help: see https://github.com/rust-lang/unsafe-code-guidelines/blob/master/wip/stacked-borrows.md for further information
help: <310> was created by a SharedReadWrite retag at offsets [0x0..0x4]
  --> src/main.rs:27:17
   |
27 |         let y = &raw mut *x;
   |                 ^^^^^^^^^^^
help: <310> was later invalidated at offsets [0x0..0x4] by a Unique retag
  --> src/main.rs:28:26
   |
28 |         let z = &raw mut *x;
   |                          ^^
   = note: BACKTRACE (of the first span):
   = note: inside `fails::<'_, ()>` at src/main.rs:29:9: 29:15
note: inside `main`
  --> src/main.rs:11:5
   |
11 |     fails::<()>(&mut 1);
   |     ^^^^^^^^^^^^^^^^^^^

note: some details are omitted, run with `MIRIFLAGS=-Zmiri-backtrace=full` for a verbose backtrace

It seems that adding the : ToMut<'a> trait bound causes the compiler to no longer see that the type of x is &mut i32. As a result, instead of using the built-in dereferencing for &mut i32, in fails, the compiler uses the DerefMut<Target = i32> bound instead.

As a result, let y = &raw mut *x; was desugared to let y = &raw mut *<&mut i32 as DerefMut>::deref_mut(&mut x);, which creates a &mut reference before turning it into a pointer. This asserts uniqueness, causing the fails function to have UB.

Meta

Reproducible on the playground with version 1.93.0-nightly (2025-11-22 94b49fd998d6723e0a92)

Start with the reproducer in src/main.rs and run it under Miri using the versions and output described in the issue. Compare works and fails, focusing on how the added ToMut<'a> bound changes raw-pointer dereferencing. Done means the behavior is resolved or documented with appropriate compiler coverage showing whether the two functions may differ.