AIKIDO-2026-90728

TL;DR

ThreadLocal::get_or and get_or_try call an internal insert routine that unconditionally writes the new value into the thread's slot and increments an internal entry counter, even when the create closure has already reentrantly initialized that same slot on the same thread. The extra increment desynchronizes the counter from the number of populated slots, so RawIter::next_mut keeps scanning past the last valid entry and indexes the bucket array out of bounds, and the overwritten slot leaves any reference already returned to the reentrant call dangling. The fix checks whether the slot is already initialized before writing and returns the existing value instead of overwriting it.