Looking at some cargo code today, I think that we have a soundness hole where we have multiple instances of a &mut pointer hiding behind trait objects:

• We have ids which are loaded into Box<Source + 'a> objects, and each Source holds a pointer to the &'a mut Config instance
• Elsewhere, we have a HashMap<SourceId, Box<Source + 'a>> which is stored in one structure.
• In the structure storing the SourceMap, we call the load method which is where we pass in the &mut Config (note that the config pointer is also stored in the structure).

What ends up happening is that each Box<Source + 'a> has a handle to the same &'a mut Config as well as the PackageRegistry having a handle on &'a mut Config. I don't think that's a sound thing to do!

I vaguely remember trying to reduce this awhile ago and was unable to, but I wanted to make sure that this was listed here!

Nominating as I think this may be a hole that needs plugging.