Do we guarantee that Vec uses the global allocation functions and has a stable, known heap layout the way we do for Box? I see they're into_rawing the Box but from_rawing a Vec; I'd expect Box::from_raw(ptr::slice_from_raw_parts(_, _)) instead.
(I can complain about mem::forgetting the value technically potentially invalidating the derived pointer since it moves the Box and needing to use ManuallyDrop or Box::into_raw instead, but that's more draconian than I think we'll want to actually settle on, given e.g. StableDeref and wanting to allow that.)
If a Vechas allocated memory, then the memory it points to is on the heap (as defined by the allocator Rust is configured to use by default), and its pointer points to len initialized, contiguous elements in order (what you would see if you coerced it to a slice), followed by capacity-len logically uninitialized, contiguous elements.