The vulnerability stems from covariant marker types in TCellOwner and TLCellOwner structs. Their new() functions perform singleton checks but don't enforce type invariance. This allows malicious actors to create different marker type variants (via Rust's subtyping) that bypass ownership checks, enabling multiple mutable references. The GitHub issue demonstrates how TCellOwner<T1> can be coerced to TCellOwner<T2>, creating two owners. The fix required making these types invariant, confirming the vulnerability was in their construction/ownership validation logic.