llama.cpp was aliasing CUB's input and output buffers, corrupting argsort and crashing speculative decoding

GitHub·high signalXBlueskyLinkedInCopy link

PR #28389, merged 2026-09-19, fixes argsort_f32_i32_cuda_cub() passing the same buffer as d_keys_in and d_keys_out, which violates CUB's contract that input and output ranges must not overlap. CUB's double-buffer ping-pong overwrote its own input mid-pass and emitted float bit patterns as row IDs, producing out-of-bounds get_rows reads and sticky 'illegal memory access' Xid 31 faults. It only fired above ncols > 1024 with real logit distributions, reproduced on Qwen3.8-27B DFlash speculative decoding with a 248,320-column vocabulary crashing within 1 to 3 tokens; the fix allocates a distinct output buffer at all six call sites for about 64 MB more transient memory per sort.