PT-2026-91408

Two independent soundness problems, both reachable from safe Rust. Map::into iter drops builder the caller-supplied hasher H and incin by hand, then commits the ownership transfer with mem::forgetself. H::drop is user code and may panic. If it does, mem::forgetself is skipped and the still-live M...