Sign reversal on an integer with minimum value is UB. push_node.cpp contains an unprotected unary minus on an integer that is based on user input. https://github.com/mongodb/mongo/blob/6d56e6da95f9aa3792f5b234edb6c9117be3663f/src/mongo/db/update/push_node.cpp#L220