The vulnerability stems from missing Send + Sync trait bounds on the generic type V in ARefss's mapping functions. The commit diff shows these bounds were added to both map() and try_map() in ARefss implementations. Before the fix, these functions allowed wrapping types that aren't thread-safe (V: !Send/!Sync) into ARefss which claims Send + Sync guarantees, enabling concurrent unsynchronized access. The PoC demonstrates how this could create data races with Cell (which is !Sync), confirming the exploit path through these functions.