The vulnerability stems from three core issues: 1) Improper Send/Sync implementations for Ptr<T> without type constraints, enabling cross-thread sharing of non-thread-safe types. 2) Ptr::get() creating multiple mutable references through raw pointer dereference, violating Rust's aliasing rules. 3) Ptr::set() using non-atomic writes, creating data race conditions. These are clearly demonstrated in the provided POC code showing Rc cloning across threads and mutable reference aliasing leading to segfaults. The GitHub issue explicitly identifies these unsafe implementations and methods as problematic.