Understanding DIP 1000 semantics -- Where's the bug?

[Walter Bright]

On 9/23/2019 1:46 AM, Olivier FAURE wrote:
> The following code compiles with -dip1000.
> 
>      @safe:
> 
>      int* foo(ref int x)
>      {
>          int* a = &x;
>          return a;
>      }

That's a bug. Not sure how I missed that. `a` should be inferred as `scope`.