in function mir_body_for_closure_query, I moved skip_binder() call earlier and used eprintln! to print whether the type has escaping bound vars. like:

    #[cfg(test)]
    eprintln!(
        "closure sig before skip_binder: {sig:?} escaping={}",
        sig.has_escaping_bound_vars()
    );
    let raw_sig = sig.skip_binder();
    #[cfg(test)]
    eprintln!(
        "closure sig after skip_binder: {raw_sig:?} escaping={}",
        raw_sig.has_escaping_bound_vars()
    );

run the panic reproduce code which print the message:

closure sig before skip_binder: Binder { value: fn(&'{region error} mut (), &'^0 [u8]) -> Res<(), ()>, bound_vars:[Region(BrAnon)] } escaping=false

closure sig after skip_binder: fn(&'{region error} mut (), &'^0 [u8]) -> Res<(), ()> escaping=true

so the root cause is here:)