Understanding DIP 1000 semantics -- Where's the bug?

[Meta]

On Monday, 23 September 2019 at 18:46:40 UTC, Meta wrote:
> AFAICT, according to dip1000 this code should not allow the 
> result of `foo(x)` to be assigned to p, as it has a longer 
> lifetime. Likewise, it should not allow foo to return &x 
> without the parameter being annotated with `return`. This looks 
> like a bug in the implementation.

Specifically, this breaks rule 1 from DIP1000:

A scope variable can only be initialized and assigned from values 
that have lifetimes longer than the variable's lifetime. (As a 
consequence a scope variable can only be assigned to scope 
variables that have shorter lifetime.)

This rule is broken by `p = foo(x)`, since p has a longer 
lifetime than x. Marking the `ref int x` parameter of foo 
`scope`, `return scope` or `scope return` did not help, but 
marking it as `return` *did* cause the compiler to correctly 
reject this code. Also changing foo to:

int* foo(ref int x)
{
     return &x;
}

OR

int* foo(int* x)
{
     return x;
}
...
p = foo(&x);

Causes the compiler to correctly reject this code, so the problem 
seems to specifically be with returning the address of a ref 
parameter stored in a local variable.