Soundness: `CastPtr::borrow_mut`

[rikosellic]

The borrow_mut method produces a mutable reference; however, we have no control over inner_perm to keep it related to the mutable reference, so when it goes out of scope, there is no way to establish final(perm).wf(&final(perm).inner_perms).

vostd/verified_libs/vstd_extra/src/cast_ptr.rs

Lines 200 to 218 in 1b22d82

	#[verifier::external_body]
	pub exec fn borrow_mut<'a>(self, Tracked(perm): Tracked<&'a mut PointsTo<R, T>>) -> (v:
	&'a mut T)
	requires
	old(perm).pptr() == self,
	old(perm).is_init(),
	old(perm).wf(&old(perm).inner_perms),
	ensures
	*v == old(perm).value(),
	final(perm).pptr() == old(perm).pptr(),
	final(perm).is_init(),
	final(perm).wf(&final(perm).inner_perms),
	final(perm).value() == *final(v),
	{
	// SAFETY: `Repr<R> for T` asserts layout compatibility between R and
	// T. The tracked `perm` guards against concurrent access.
	unsafe { &mut *(self.ptr.addr() as *mut T) }
	}
	}

[rikosellic]

Since this is a temporary workaround for dyn, I'm fine with leaving it as is. But we should solve this ultimately.