arrwiden

confirmedupstream bugC++ · CPUInference & servingJuly 13, 2026

the question

Does a GGUF that declares tokenizer.ggml.suppress_tokens as an INT8 array cause a heap over-read when llama.cpp loads the vocabulary?

what came out

Confirmed bug. gguf_get_arr_n returns the byte count for an INT8 array, and the loader reinterprets the N-byte buffer as N int32, copying 4*N bytes for a 3*N-byte over-read. A 64Mi INT8 suppress array crashes model load with SIGSEGV; a same-byte-size INT32 array loads cleanly. Poisoned-model DoS on the default load path.

method & receipts

Result: confirmed
Pre-registered — the prediction was written down and committed before the run.
Reproducible — one script re-runs the whole thing from scratch.
Tested — a correctness/benchmark suite ships alongside the code.

→ read the code and re-run it

github.com/v-code01/arrwiden