The vulnerability stems from improper Sync trait implementation on GenericMutexGuard. The original implementation only required T: Send for Sync, but should have required T: Send + Sync to prevent cross-thread sharing of guarded data that isn't thread-safe. This allowed sending Sync-marked guards containing non-Sync types like Cell to different threads, enabling data races through safe code as demonstrated in the PoC. The trait implementation itself (not a specific function) was the vulnerable component, but we represent it as the Sync trait impl in the structure's definition.