GHSA-3632-54q8-m96x: arenavec has multiple memory corruption vulnerabilities in safe APIs

The analysis identified multiple memory corruption vulnerabilities in the arenavec crate, stemming from three distinct issues reported on GitHub. Since no patches are available, the analysis is based on the detailed bug reports, which include proofs-of-concept and point to the exact sources of the vulnerabilities.

The root causes are:

1. Improper Trust (CWE-822): The AllocHandle trait is not declared unsafe, yet the library's internal code makes unsafe assumptions about the validity of pointers returned by user implementations of this trait. This leads to an untrusted pointer dereference in SliceVec::push.
2. Heap Buffer Overflow (CWE-122): The allocate_inner function, called by SliceVec::reserve, can fail to allocate memory while still increasing the vector's capacity. This causes SliceVec::push to write past the buffer's boundary.
3. Double Free (CWE-415): The SliceVec::split_off function incorrectly handles ownership when splitting at index 0, leading to two SliceVec instances pointing to the same data. When both are dropped, the data is freed twice.

The identified vulnerable functions are the public APIs that trigger these conditions (push, reserve, split_off) and the underlying trait methods and private functions where the flaws reside (AllocHandle::allocate, AllocHandle::allocate_or_extend, allocate_inner). Any of these functions could appear in a runtime profile during exploitation.