What are Rust's "borrow checker soundness holes"?

A year ago u/nyanpasu64 wrote in a comment:

Also even safe Rust has both borrow checking soundness holes and provenance-based LLVM miscompilations.

I'm curious what those borrow checker soundness holes are. I couldn't find anything about this. Are those just bugs in the current implementation or conceptual flaws in the algorithms?