Potential soundness issue: `BorrowedHeaders` appears constructible in safe Rust; `detach()` may segfault under ASan

[cicilzx]

Hi! I'm currently developing a fuzzer to test safe abstractions in Rust crates. While testing rdkafka, I ran into a case where a safe sequence of calls appears to trigger a segmentation fault under AddressSanitizer (ASan).

Environment

• OS: Linux x86_64 (Ubuntu)
• Rust toolchain: nightly-2024-12-15
• rdkafka version: 0.39.0
• Sanitizer: AddressSanitizer (ASan)

Minimal reproduction

extern crate rdkafka;

fn main() {
    let headers = rdkafka::message::BorrowedHeaders;
    let headers_ref = &headers;
    let _ = headers_ref.detach();
}

Build & run

ASAN_OPTIONS="detect_leaks=0" RUST_BACKTRACE=1 \
cargo +nightly-2024-12-15 rustc --bin test1 -- -Zsanitizer=address && \
./target/debug/test1

Observed behavior

ASan reports a SEGV (read access) and aborts, e.g.:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==3044412==ERROR: AddressSanitizer: SEGV on unknown address 0x4c0000040000 (pc 0x5cffcd9dedf0 bp 0x5cffcd9dfa00 sp 0x7ffddd9201c8 T0)
==3044412==The signal is caused by a READ memory access.
SUMMARY: AddressSanitizer: SEGV

Expected behavior / concern

Since the reproduction uses only safe Rust, I would expect one of the following to hold:

• BorrowedHeaders should not be directly constructible in safe code, or
• detach() should fail safely (e.g., return an error / panic), rather than triggering UB / a segfault.

If helpful, I’m happy to provide additional details. Thanks for taking a look!