The advisory explicitly names both through() and through_and() as vulnerable entry points. The root cause is their use of ptr::read to create duplicate ownership without proper panic safety guards. When the user-provided closure panics, both the original value and the ptr::read copy get dropped. The reproduction example demonstrates this with through::through, and the advisory confirms the same pattern exists in through_and. The file path is inferred as src/lib.rs as this is the standard entry point for Rust crates.