A use-after-free in the LTX-2.5 device path is caught ONLY by sanitize-cpu, which is continue-on-error — that is how #904 landed

[localai-bot]

Filed from the #936 review, which established the gap with a mutation rather than an argument.

The measurement

With the #936 fix reverted, in a plain Release build with no sanitizer:

git diff HEAD --stat : 2 insertions(+), 8 deletions(-)
BUILT                : yes, compile_err=0
RUN_EXIT             : 0
[doctest] test cases:  18 |  18 passed | 0 failed | 0 skipped
[doctest] assertions: 546 | 546 passed | 0 failed |

The unfixed test passes cleanly. The dtype field lives in the vt::Tensor struct rather than in the freed buffer, so even the refusal path cannot notice garbage. Nothing in the ordinary gate can see it.

The only instrument that catches it is the ASan/TSan lane — and that lane is continue-on-error: true with cancel-in-progress on push and pull request.

How that played out, concretely

#904 was introduced by #880 (98f8e046d, git blame on lines 723-726, today). It passed:

• a full 477/477 CPU-only Release operator gate — structurally incapable of detecting a use-after-free;
• CI, because sanitize-cpu is continue-on-error and its red was read as the known test_openai_api_server crashes on Windows with STATUS_STACK_BUFFER_OVERRUN (0xC0000409), unmasked by the #512 fix #584 "no main baseline" lane rather than as a specific ASan report.

I was the operator on that merge and made the second mistake explicitly. Matching a red to a job name rather than to a defect is what turned a working detector into no detector.

What is owed

The #936 spec records this under ## Owed with no issue and no index row, so it is discoverable only by reading that spec. This issue is that record.

A fix needs to answer: what fails, in a lane someone reads, when this pattern returns? Options worth weighing rather than a foregone conclusion —

• promote sanitize-cpu off continue-on-error once its main baseline exists (it is green on both arms today at bc6433d1b, so the baseline is now obtainable);
• or add a targeted test that fails without a sanitizer — harder here, since the dangling read produces no observable difference in the assertions;
• or gate the pattern statically: a checker rejecting a member access chained onto a call that returns an owning type by value. The fix(FIX-LTX2-DEVICE-UAF-904): the staged view outlived the temporary that owned it (#904) #936 review built exactly such a detector, proved it on the pre-fix text, and swept 1777 files with zero other hits — so the detector is known to work and is cheap.

The third is the only one that catches the defect before it runs, and it already exists in prototype.

Related: #904, #936, #880, #584, #944.

FOLLOWING_AGENTS_PROTOCOL