AIKIDO-2026-542614

TL;DR

AdvancedSeekable implements DerefMut, exposing a mutable reference to its inner Seekable context while a raw pointer to the boxed reader stays behind in the same struct. Safe code can call mem::swap on that reference to move the C context into an unrelated Seekable value, and dropping the original AdvancedSeekable then frees the boxed reader while the swapped-in context still holds a pointer into it. A later decompression call on the swapped context dereferences that freed reader through the FFI read/seek callbacks, producing a heap use after free. The fix removes the DerefMut implementation so callers can no longer split the context from its backing reader.