Reading the text, it also seems hard for MITRE to set general rules for when undefined memory access is a vulnerability.

Here it is not exploitable because it is only in a debug build and because the accessed memory is out-of-bounds in the intended context, but provably always within the memory bounds that are readable by curl, if I understand correctly.

For a case like this, it is easy to imagine this being one or two steps away from an actual vulnerability without having any actual security impact as-is.

So, not a vulnerability.

But requires explanation on why it isn't one.