Hmm, amazing it remained unrevealed for long time.

I was also surprised after realizing this bug has been there for at least 15 years. I guess the reason is copy_fn is not used in many places and as long as the output iterator is implicitly convertible to the input iterator (as it is the case for pointers which only differ in their const-qualifier), everything is fine.

How did you find it out?

Just me, the algorithm header and a cup of coffee.