https://issues.dlang.org/show_bug.cgi?id=20956

          Issue ID: 20956
           Summary: [DIP1000] @safe defeated by closure capturing ref
                    parameter
           Product: D
           Version: D2
          Hardware: All
                OS: All
            Status: NEW
          Keywords: safe
          Severity: major
          Priority: P1
         Component: dmd
          Assignee: nobody@puremagic.com
          Reporter: pro.mathias.lang@gmail.com

```
import std.stdio;

struct Container { int[10] arr; }

void main () @safe
{
    auto dg = getDg(42);
    stompStack();
    dg();
}

auto getDg (int val) @safe
{
    Container c;
    c.arr[] = val;
    return forwardDg(c);
}

auto forwardDg (scope ref Container c) @safe
{
    return () => writeln(c);
}

void stompStack () @safe
{
    int[256] oops = int.max;
}
```

This should print:
```
Container([42, 42, 42, 42, 42, 42, 42, 42, 42, 42])
```

Instead it prints:
```
Container([2147483647, 2147483647, 2147483647, 2147483647, 2147483647,
2147483647, 2147483647, 2147483647, 2147483647, 2147483647])
```

Compiled with `-preview=dip1000`. I would have tried `-preview=dip1021` if it didn't SEGV the compiler.

```
% dmd | head -n 1
DMD64 D Compiler v2.092.1
```

--