The vulnerability stems from unsafe memory initialization patterns in array deserialization functions. The commit diff shows both functions were using std::mem::uninitialized() followed by pointer writes in a loop, which creates a partially initialized array if any element deserialization panics. The patch replaced this with safe initialization via Vec collection and try_into(), confirming these were the vulnerable functions. The CWE-908 (Uninitialized Resource) mapping and GitHub issue reproduction both directly implicate these array deserialization methods.