Rocq Prover 9.1.0 Higher Order Fixpoint Guard Checker Bypass

Rocq Prover version 9.1.0 and earlier contain a kernel soundness vulnerability in the termination guard checker. The checker incorrectly accepts recursive functions passed as higher order arguments to other fixpoints, allowing recursive calls on values that are not structurally decreasing. This...