AIKIDO-2026-882584

TL;DR

Wrapping a future or stream whose state is !Unpin in Fragile or Sticky and polling it previously still let the wrapper count as Unpin while keeping the wrapped value stored inline, so the whole wrapper, including the pinned value, could still be moved by ordinary safe code such as into_inner or a container swap after a pinned reference had already been handed out. Moving a !Unpin value after it has been pinned breaks the pinning guarantee its Future implementation relies on, so self-referential pointers it holds become stale, which can corrupt memory on the next poll. The fix moves the value to stable, pinned heap storage before the first poll and makes the wrapper Unpin only when the wrapped value is, so a pinned !Unpin value can no longer be moved out.