RUSTSEC-2026-0454: Data race and double free via unsound `Send`/`Sync` in `reblessive`

dbs::Executor drives every SurrealQL statement through reblessive::tree::TreeStack. In reblessive 0.4.3 the runtime types unconditionally assert Send/Sync (unsafe impl Send/Sync for Stack, TreeStack and Runner), while the public entry points accept any future without a Send bound and store it type-erased in a bump allocator.

Two safe-code consequences follow. First, Runner::stepasync/finishasync return driver futures tied to the stack borrow rather than to &mut self, so a driver future can be duplicated; because Stack is Sync those futures are Send, and polling two copies on different threads runs drivetoptask concurrently — racy Cell/UnsafeCell access, double poptask()/popdealloc() (double drop / double free) and a non-atomic Option::take. Second, TreeStack: Send lets safe code move a driver whose type-erased future captures !Send state (Rc, RefCell) to another thread while the creating thread keeps an alias of that state.

No unsafe is needed at the call site. surrealdb-core's own query futures are Send only because of the unsound unsafe impl Send for TreeStack, while the captured &mut tree::Stk is deliberately !Send.

The unsound dependency was removed in 4.0.0 and the parser now uses plain recursion (commit 75407c4bcc).