Incorrect cast – is it the cast or the use which is undefined behavior

The cast itself has undefined behaviour. Quoting C++17 (n4659) [expr.static.cast] 8.2.10/11:

A prvalue of type “pointer to cv1 B”, where B is a class type, can be converted to a prvalue of type “pointer
to cv2 D”, where D is a class derived (Clause 13) from B, if cv2 is the same cv-qualification as, or greater
cv-qualification than, cv1. … If the prvalue of
type “pointer to cv1 B” points to a B that is actually a subobject of an object of type D, the resulting pointer
points to the enclosing object of type D. Otherwise, the behavior is undefined.