Proposed resolution (approved by CWG 2025-11-04):

Change in 9.7 [dcl.struct.bind] paragraph 7:

Otherwise, if the qualified-id std::tuple_size<E> names a complete class type with a member named value, the expression std::tuple_size<E>::value shall be a well-formed integral constant expression whose value is non-negative; and the structured binding size of E is equal to the that value of that expression. ...

(From submission #764.)

Consider:

  namespace std {
    template <typename T> struct tuple_size;
  }

  struct S {
    int a;
  };

  template <> struct std::tuple_size<S> {
    static constexpr int value = -1;
  };

  void f(auto) { auto [... a] = S{}; }

There is no protection against negative tuple_size.