batchvalorder

confirmedupstream bugC++Inference & servingJuly 13, 2026

the question

Does llama_batch_allocr::init read batch.n_seq_id[i] before the auto-generator that fills n_seq_id when it is NULL, dereferencing a NULL pointer?

what came out

Confirmed. Supplying seq_id with n_seq_id NULL, a combination the function's own auto-generator contracts to accept, makes L60 dereference NULL[i] before L73 fills it, crashing with SIGSEGV. Exactly one of the four {seq_id, n_seq_id} x {supplied, NULL} cells faults; the mirror case with seq_id NULL is handled.

method & receipts

Result: confirmed
Pre-registered — the prediction was written down and committed before the run.
Reproducible — one script re-runs the whole thing from scratch.
Tested — a correctness/benchmark suite ships alongside the code.

→ read the code and re-run it

github.com/v-code01/batchvalorder