The vulnerability occurs in the From<[E; $len]> implementation shown in event.rs lines 1037-1050. The code uses ptr::read to transfer ownership of array elements to the EventList, then calls mem::forget on the original array. However, if a panic occurs in the user-provided Into<Event> conversion during the loop, the mem::forget never executes, causing the original array to be dropped normally. This results in double-free of elements that were already moved via ptr::read and potentially dropped during stack unwinding. The GitHub issue (#194) specifically demonstrates this scenario and confirms the lack of panic safety mechanisms like ManuallyDrop.