Polonius soundness bug with higher ranked function pointers

I'm filing this issue on behalf of @carlini, who discovered the initial unsoundness reproducer with an LLM. I then minimized the code to the code below.

The code below creates a &mut that aliases with a &, and somehow uses both of them, causing unsoundness. The aliasing references are r and p.

#![forbid(unsafe_code)]

type Payload = Option<Box<i32>>;

type P<'a, 'b> = for<'x> fn(&'a mut &'b Payload, &'x ()) -> &'x Payload;

fn f<'a, 'b, 'c>(x: &'a mut &'b Payload, _: &'c ()) -> &'b Payload {
    *x
}

fn main() {
    let p: &'static mut Payload = Box::leak(Box::new(Some(Box::new(1))));
    let mid: &mut &Payload = Box::leak(Box::new(&*p));
    let r: &Payload = (f as P<'_, '_>)(mid, &());
    let b: &Box<i32> = r.as_ref().unwrap();
    if false {
        let _: &mut &'static Payload = mid;
    } else {
        *p = None;
        println!("{b}");  // Segfault
    };
}

The unsoundness reproduces with -Zpolonius=next, but doesn't reproduce (fails to compile) with -Zpolonius=no.

Meta

Reproducible on the playground with version 1.100.0-nightly (2026-08-20 8925ea358a0f265ca610)

Start with the minimized Rust program in the issue and reproduce it on the stated nightly using -Zpolonius=next; compare with -Zpolonius=no, which currently rejects it. Investigate Polonius handling of the higher-ranked function pointer and the aliasing references r and p. Done means the reproducer no longer permits unsound aliasing or produces the shown failure.