Add GGUF typeconf post-load binary_op abort PoC

.gitattributes

@@ -33,3 +33,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+m_00266_typeconf_postload_binaryop_abort.gguf filter=lfs diff=lfs merge=lfs -text

FINAL_HUNTR_FORM.md

@@ -0,0 +1,144 @@
+# TITLE
+
+Malformed GGUF triggers post-load abort in ggml binary_op due to model-controlled tensor type confusion
+
+# TARGET
+
+llama.cpp / GGUF (.gguf)
+
+# VULNERABILITY TYPE
+
+Model File Vulnerability / malformed GGUF triggered post-load denial of service
+
+# AFFECTED FORMAT
+
+GGUF
+
+# AFFECTED PROJECT
+
+llama.cpp / ggml model loading and inference path
+
+# SUMMARY
+
+A malformed GGUF model file is accepted far enough to load and enter the inference/compute graph, then triggers a fatal abort in ggml's CPU binary operation path.
+
+The crash occurs after model loading, during llama-bench decode/inference, not as a clean loader rejection.
+
+The failing operation is:
+
+ggml/src/ggml-cpu/binary-ops.cpp:135:
+binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+The stack reaches:
+
+binary_op<op_mul>
+ggml_compute_forward_mul
+ggml_compute_forward
+ggml_graph_compute_thread
+ggml_backend_sched_graph_compute_async
+llama_context::decode
+llama_decode
+llama-bench
+
+This is not an arbitrary code execution claim and not a memory-corruption claim. The demonstrated impact is malformed model-file-triggered denial of service via a post-load compute graph abort.
+
+# POC FILE
+
+m_00266_typeconf_postload_binaryop_abort.gguf
+
+# SHA256
+
+See POC_SHA256.txt.
+
+# ROOT CAUSE
+
+The malformed GGUF changes tensor type metadata such that the constructed computation graph later attempts a binary multiply operation with an unsupported operand combination:
+
+dst: f32
+src0: f32
+src1: i32
+
+Instead of rejecting the malformed tensor/type combination before execution, the model reaches the compute graph and aborts inside ggml/src/ggml-cpu/binary-ops.cpp.
+
+# REPRODUCTION
+
+Tested against llama.cpp commit:
+
+9f5f0e689c9e977e5f23a27e344aa36082f44738
+
+Run:
+
+./build-huntr-clean-rel/bin/llama-bench \
+  -m ./m_00266_typeconf_postload_binaryop_abort.gguf \
+  -p 1 -n 1
+
+Expected result:
+
+binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+EXIT_CODE=134
+
+Sanitizer build also reproduces:
+
+ASAN_OPTIONS=abort_on_error=1:detect_leaks=0 \
+UBSAN_OPTIONS=print_stacktrace=1:halt_on_error=0 \
+./build-huntr-sani-hard/bin/llama-bench \
+  -m ./m_00266_typeconf_postload_binaryop_abort.gguf \
+  -p 1 -n 1
+
+# OBSERVED EVIDENCE
+
+The verification artifacts show:
+
+seed_rel_exit: 0
+mut_rel_exit: 134
+seed_san_exit: 0
+mut_san_exit: 134
+has_load_reject_signal: 0
+has_loaded_table_signal: 1
+has_asan_memory_corruption: 0
+has_fpe_or_zero_dim_style_signal: 0
+
+The mutant therefore differs from a clean loader rejection: it reaches model execution before aborting.
+
+# SECURITY IMPACT
+
+A third-party GGUF file can terminate llama.cpp during model execution after being accepted past initial loading.
+
+This is relevant because GGUF models are commonly downloaded from third-party model repositories and loaded directly into local inference tools. A malformed model file should be rejected safely before constructing an invalid compute graph that aborts the process.
+
+This report does not claim RCE, ACE, heap overflow, stack overflow, or arbitrary write. The demonstrated impact is denial of service via malformed model-file-triggered post-load abort.
+
+# NON-DUPLICATE BOUNDARY
+
+This report is distinct from already-submitted GGUF division-by-zero and IQ3_S signed-left-shift reports.
+
+This report is specifically:
+
+- file: ggml/src/ggml-cpu/binary-ops.cpp
+- line: 135
+- function family: binary_op<op_mul> / ggml_compute_forward_mul
+- issue: post-load unsupported type combination in compute graph
+- observed unsupported combination: dst: f32, src0: f32, src1: i32
+- trigger: malformed GGUF tensor type mutation
+- impact: release and sanitizer abort after load
+
+It is not:
+
+- gguf.cpp division by zero
+- zero tensor dimension ne[1] == 0
+- IQ3_S signed left-shift UB in ggml_vec_dot_iq3_s_q8_K
+- invalid metadata enum load rejection
+- tensor block-size load rejection
+- Keras native output manipulation
+- Keras get_file cache traversal
+
+# SUGGESTED FIX
+
+Validate tensor type combinations before graph execution.
+
+Potential fix direction:
+
+1. During GGUF loading/model graph construction, validate that tensor types used in binary operations are supported for the selected backend.
+2. Reject malformed or inconsistent tensor type combinations before decode/inference begins.
+3. Replace fatal GGML_ABORT for model-controlled unsupported type combinations with a safe error return path where practical.
+4. Add regression tests with malformed GGUF tensors that attempt f32 * i32 binary-op combinations.

HUNTR_TRIAGE_NOTE.md

@@ -0,0 +1,22 @@
+# GGUF type-confusion release abort after load
+
+## Summary
+
+A crafted GGUF tensor descriptor changing tensor type metadata for `blk.5.attn_norm.weight` from type `0` to `26` causes llama.cpp to load far enough to enter benchmark/inference setup, then abort during CPU binary op execution with:
+
+```text
+binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+EXIT_CODE=134
+```
+
+## Important severity boundary
+
+This is not currently memory corruption. ASAN/UBSAN did not show heap/stack overflow or UAF in this verification. This should be treated as model-file-triggered denial-of-service / robustness issue unless further evidence shows memory corruption.
+
+## Duplicate boundary
+
+This is not the zero-dimension SIGFPE lane and not the known integer-overflow heap-overflow lane. It is a tensor type metadata confusion / unsupported mixed-type operation abort.
+
+## Submission decision
+
+Only submit if the program accepts model-file-triggered release abort / DoS after load. Do not present as ACE or memory corruption.

POC_SHA256.txt

@@ -0,0 +1 @@
+0032a33e78fde8347bd7106d3b14702f3045b17643b10bc4ca61ad1eceb7219a  /home/nur/am_gguf_lab/huntr_runs/typeconf_v14_clean_20260511_095334/submission_typeconf_v14_m00266_postload_binaryop_abort/m_00266_typeconf_postload_binaryop_abort.gguf

README.md

@@ -0,0 +1,21 @@
+# GGUF post-load binary_op type confusion abort PoC
+
+This repository contains a malformed GGUF PoC for a Huntr Model File Vulnerability report.
+
+The PoC loads far enough to reach llama.cpp / ggml compute graph execution, then aborts in:
+
+ggml/src/ggml-cpu/binary-ops.cpp:135
+
+Observed failure:
+
+binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+Primary PoC:
+
+- m_00266_typeconf_postload_binaryop_abort.gguf
+
+Primary report:
+
+- FINAL_HUNTR_FORM.md
+
+This is not RCE and not memory corruption. It is a malformed model-file-triggered post-load denial-of-service issue.

SHA256SUMS.txt

@@ -0,0 +1,2 @@
+d964b672125668da0d72a1a3254b7ec09a69cc65455ffc04f5eab11ffd6f28f7  /home/nur/am_gguf_lab/full_model_seeds/TinyLLama-v0-Q2_K.gguf
+0032a33e78fde8347bd7106d3b14702f3045b17643b10bc4ca61ad1eceb7219a  /home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/m_00266.gguf

VERDICT.json

@@ -0,0 +1,16 @@
+{
+  "verdict": "CONFIRMED_TYPECONF_RELEASE_ABORT_AFTER_LOAD",
+  "seed_rel_exit": "0",
+  "mut_rel_exit": "134",
+  "seed_san_exit": "0",
+  "mut_san_exit": "134",
+  "has_unsupported_types_signal": 1,
+  "has_asan_memory_corruption": 0,
+  "has_fpe_or_zero_dim_style_signal": 0,
+  "has_load_reject_signal": 0,
+  "has_loaded_table_signal": 1,
+  "mutation": "TYPE_t49_blk.5.attn_norm.weight_0_to_26",
+  "mutant": "/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/m_00266.gguf",
+  "seed": "/home/nur/am_gguf_lab/full_model_seeds/TinyLLama-v0-Q2_K.gguf",
+  "commit": "9f5f0e689c9e977e5f23a27e344aa36082f44738"
+}

VERIFY_ALL_LOGS.txt

@@ -0,0 +1,336 @@
+DATE=2026-05-10T10:16:04+05:00
+SOURCE_RUN=/home/nur/am_gguf_lab/huntr_runs/gguf_v10_typeconf_20260510_095020
+SOURCE_MODEL=/home/nur/am_gguf_lab/huntr_runs/gguf_v10_typeconf_20260510_095020/mutants/m_00266.gguf
+MUT_COPY=/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/m_00266.gguf
+SEED=/home/nur/am_gguf_lab/full_model_seeds/TinyLLama-v0-Q2_K.gguf
+REPO=/home/nur/am_gguf_lab/repos/llama.cpp
+COMMIT=9f5f0e689c9e977e5f23a27e344aa36082f44738
+9f5f0e689 model : support Gemma4_26B_A4B_NVFP4 (#22804)
+
+SEED_SHA256=d964b672125668da0d72a1a3254b7ec09a69cc65455ffc04f5eab11ffd6f28f7
+MUT_SHA256=0032a33e78fde8347bd7106d3b14702f3045b17643b10bc4ca61ad1eceb7219a
+
+===== MUTATION LABEL =====
+/home/nur/am_gguf_lab/huntr_runs/gguf_v10_typeconf_20260510_095020/mutants/manifest.tsv:268:266	/home/nur/am_gguf_lab/huntr_runs/gguf_v10_typeconf_20260510_095020/mutants/m_00266.gguf	TYPE_t49_blk.5.attn_norm.weight_0_to_26	0032a33e78fde8347bd7106d3b14702f3045b17643b10bc4ca61ad1eceb7219a
+/home/nur/am_gguf_lab/huntr_runs/gguf_v10_typeconf_20260510_095020/mutants/queue.tsv:268:266	/home/nur/am_gguf_lab/huntr_runs/gguf_v10_typeconf_20260510_095020/mutants/m_00266.gguf	TYPE_t49_blk.5.attn_norm.weight_0_to_26
+
+/home/nur/am_gguf_lab/full_model_seeds/TinyLLama-v0-Q2_K.gguf: GGUF file format version 3, 75 tensors, 26 metadata entries, Architecture: llama, Name: Maykeye TinyLLama v0, Block Count: 8, Context Length: 2048, Embedding Length: 64
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/m_00266.gguf: GGUF file format version 3, 75 tensors, 26 metadata entries, Architecture: llama, Name: Maykeye TinyLLama v0, Block Count: 8, Context Length: 2048, Embedding Length: 64
+===== mut_rel_deep =====
+BIN=/home/nur/am_gguf_lab/repos/llama.cpp/build-huntr-clean-rel/bin/llama-bench
+MODEL=/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/m_00266.gguf
+ARGS=-p 256 -n 128
+| model                          |       size |     params | backend    | threads |            test |                  t/s |
+| ------------------------------ | ---------: | ---------: | ---------- | ------: | --------------: | -------------------: |
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+❌️ ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+❌️ ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+❌️ ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+❌️ Unable to attach: program terminated with signal SIGABRT, Aborted.
+❌️ No stack.
+❌️ The program is not being run.
+timeout: the monitored command dumped core
+EXIT_CODE=134
+===== mut_rel_quick =====
+BIN=/home/nur/am_gguf_lab/repos/llama.cpp/build-huntr-clean-rel/bin/llama-bench
+MODEL=/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/m_00266.gguf
+ARGS=-p 1 -n 1
+| model                          |       size |     params | backend    | threads |            test |                  t/s |
+| ------------------------------ | ---------: | ---------: | ---------- | ------: | --------------: | -------------------: |
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+❌️ ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+❌️ warning: process 372585 is already traced by process 372592
+ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+[New LWP 372588]
+[New LWP 372587]
+[New LWP 372586]
+❌️ warning: process 372585 is already traced by process 372592
+ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+
+This GDB supports auto-downloading debuginfo from the following URLs:
+  <https://debuginfod.archlinux.org>
+Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
+Debuginfod has been disabled.
+To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
+[Thread debugging using libthread_db enabled]
+Using host libthread_db library "/usr/lib/libthread_db.so.1".
+0x00007f3f200a0a52 in ?? () from /usr/lib/libc.so.6
+#0  0x00007f3f200a0a52 in ?? () from /usr/lib/libc.so.6
+#1  0x00007f3f20094abc in ?? () from /usr/lib/libc.so.6
+#2  0x00007f3f20094b04 in ?? () from /usr/lib/libc.so.6
+#3  0x00007f3f20105c6f in wait4 () from /usr/lib/libc.so.6
+#4  0x000055abec515a9b in ggml_print_backtrace () at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml.c:234
+234	        waitpid(child_pid, NULL, 0);
+#5  0x000055abec515c28 in ggml_abort (file=0x55abec5fed78 "/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp", line=135, fmt=0x55abec5fedc0 "%s: unsupported types: dst: %s, src0: %s, src1: %s\n") at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml.c:268
+268	        ggml_print_backtrace();
+#6  0x000055abec4b8f74 in binary_op<op_mul> (params=<optimized out>, dst=0x55abf764acb0) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135
+135	        GGML_ABORT("%s: unsupported types: dst: %s, src0: %s, src1: %s\n", __func__,
+#7  ggml_compute_forward_mul (params=0x7ffca3433300, dst=dst@entry=0x55abf764acb0) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:149
+149	    binary_op<op_mul>(params, dst);
+#8  0x000055abec4b07b5 in ggml_compute_forward (params=0x7ffca3433300, tensor=0x55abf764acb0) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:1737
+1737	                ggml_compute_forward_mul(params, tensor);
+#9  ggml_graph_compute_thread (data=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:3049
+3049	            ggml_compute_forward(&params, node);
+#10 0x00007f3f20ee4909 in GOMP_parallel () from /usr/lib/libgomp.so.1
+#11 0x000055abec4b1da5 in ggml_graph_compute (cgraph=0x55abf720ffc8, cplan=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:3319
+3319	        #pragma omp parallel num_threads(n_threads)
+#12 0x000055abec47a6d5 in ggml_backend_cpu_graph_compute (backend=<optimized out>, cgraph=0x55abf720ffc8) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.cpp:190
+190	    return ggml_graph_compute(cgraph, &cplan);
+#13 0x000055abec53069d in ggml_backend_graph_compute_async (backend=<optimized out>, cgraph=0x55abf720ffc8) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-backend.cpp:452
+452	    return backend->iface.graph_compute(backend, cgraph);
+#14 ggml_backend_sched_compute_splits (sched=0x55abf71d92a0) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-backend.cpp:1678
+1678	            enum ggml_status ec = ggml_backend_graph_compute_async(split_backend, &split->graph);
+#15 ggml_backend_sched_graph_compute_async (sched=0x55abf71d92a0, graph=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-backend.cpp:1901
+1901	    return ggml_backend_sched_compute_splits(sched);
+#16 0x000055abec30f240 in llama_context::graph_compute (this=this@entry=0x55abf7577fd0, gf=0x55abf762fb30, batched=<optimized out>) at /usr/include/c++/16.1.1/bits/unique_ptr.h:192
+192	      pointer    _M_ptr() const noexcept { return std::get<0>(_M_t); }
+#17 0x000055abec3110e4 in llama_context::process_ubatch (this=this@entry=0x55abf7577fd0, ubatch=..., gtype=gtype@entry=LLM_GRAPH_TYPE_DECODER, mctx=mctx@entry=0x55abf71ac4c0, ret=@0x7ffca3438ed4: GGML_STATUS_SUCCESS) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-graph.h:648
+648	    ggml_cgraph  * get_gf()  const { return gf; }
+#18 0x000055abec3180b2 in llama_context::decode (this=0x55abf7577fd0, batch_inp=...) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-context.cpp:1692
+1692	        const auto * res = process_ubatch(ubatch, LLM_GRAPH_TYPE_DECODER, mctx.get(), status);
+#19 0x000055abec319a7e in llama_decode (ctx=<optimized out>, batch=...) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-context.cpp:3747
+3747	    const int ret = ctx->decode(batch);
+#20 0x000055abec24bb7e in test_prompt (ctx=ctx@entry=0x55abf7577fd0, n_prompt=1, n_batch=2048, n_threads=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/tools/llama-bench/llama-bench.cpp:2082
+2082	        int res = llama_decode(ctx, llama_batch_get_one(tokens.data(), n_tokens));
+#21 0x000055abec245321 in main (argc=<optimized out>, argv=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/tools/llama-bench/llama-bench.cpp:2306
+2306	                bool res = test_prompt(ctx, t.n_prompt, t.n_batch, t.n_threads);
+[Inferior 1 (process 372585) detached]
+timeout: the monitored command dumped core
+EXIT_CODE=134
+===== mut_san_deep =====
+BIN=/home/nur/am_gguf_lab/repos/llama.cpp/build-huntr-sani/bin/llama-bench
+MODEL=/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/m_00266.gguf
+ARGS=-p 256 -n 128
+warning: sanitizer enabled, performance may be affected
+| model                          |       size |     params | backend    | threads |            test |                  t/s |
+| ------------------------------ | ---------: | ---------: | ---------- | ------: | --------------: | -------------------: |
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+[New LWP 372938]
+[New LWP 372937]
+[New LWP 372936]
+❌️ warning: process 372935 is already traced by process 372942
+ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+❌️ warning: process 372935 is already traced by process 372942
+ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+❌️ warning: process 372935 is already traced by process 372942
+ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+
+This GDB supports auto-downloading debuginfo from the following URLs:
+  <https://debuginfod.archlinux.org>
+Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
+Debuginfod has been disabled.
+To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
+[Thread debugging using libthread_db enabled]
+Using host libthread_db library "/usr/lib/libthread_db.so.1".
+0x00007f821c2a0a52 in ?? () from /usr/lib/libc.so.6
+#0  0x00007f821c2a0a52 in ?? () from /usr/lib/libc.so.6
+#1  0x00007f821c294abc in ?? () from /usr/lib/libc.so.6
+#2  0x00007f821c294b04 in ?? () from /usr/lib/libc.so.6
+#3  0x00007f821c305c6f in wait4 () from /usr/lib/libc.so.6
+#4  0x00007f821da7fab5 in ?? () from /usr/lib/libasan.so.8
+#5  0x000055e4be71b4e9 in ggml_print_backtrace () at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml.c:234
+234	        waitpid(child_pid, NULL, 0);
+#6  0x000055e4be71b883 in ggml_abort (file=<optimized out>, line=<optimized out>, fmt=0x55e4bf046380 "%s: unsupported types: dst: %s, src0: %s, src1: %s\n") at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml.c:268
+268	        ggml_print_backtrace();
+#7  0x000055e4be410c92 in binary_op<op_mul> (params=<optimized out>, dst=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135
+135	        GGML_ABORT("%s: unsupported types: dst: %s, src0: %s, src1: %s\n", __func__,
+#8  ggml_compute_forward_mul (params=params@entry=0x7b821a22e450, dst=dst@entry=0x7b8218eea9a0) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:149
+149	    binary_op<op_mul>(params, dst);
+#9  0x000055e4be3ab146 in ggml_compute_forward (params=<optimized out>, tensor=0x7b8218eea9a0) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:1737
+1737	                ggml_compute_forward_mul(params, tensor);
+#10 ggml_graph_compute_thread (data=data@entry=0x7d521b3e5080) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:3049
+3049	            ggml_compute_forward(&params, node);
+#11 0x000055e4be3b0a7e in ggml_graph_compute._omp_fn.0 () at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:3335
+3335	            ggml_graph_compute_thread(&threadpool->workers[ith]);
+#12 0x00007f821e1f9909 in GOMP_parallel () from /usr/lib/libgomp.so.1
+#13 0x000055e4be3b9293 in ggml_graph_compute (cgraph=<optimized out>, cplan=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:3319
+3319	        #pragma omp parallel num_threads(n_threads)
+#14 0x000055e4be235771 in ggml_backend_cpu_graph_compute (backend=<optimized out>, cgraph=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.cpp:190
+190	    return ggml_graph_compute(cgraph, &cplan);
+#15 0x000055e4be7b6d15 in ggml_backend_graph_compute_async (backend=<optimized out>, cgraph=0x7da21b3e3208) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-backend.cpp:452
+452	    return backend->iface.graph_compute(backend, cgraph);
+#16 ggml_backend_sched_compute_splits (sched=0x7d221b3e1280) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-backend.cpp:1678
+1678	            enum ggml_status ec = ggml_backend_graph_compute_async(split_backend, &split->graph);
+#17 ggml_backend_sched_graph_compute_async (sched=0x7d221b3e1280, graph=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-backend.cpp:1901
+1901	    return ggml_backend_sched_compute_splits(sched);
+#18 0x000055e4bcf9f8c2 in llama_context::graph_compute (this=this@entry=0x7d021b3e0080, gf=<optimized out>, batched=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-context.cpp:2191
+2191	    auto status = ggml_backend_sched_graph_compute_async(sched.get(), gf);
+#19 0x000055e4bcfc19c0 in llama_context::process_ubatch (this=this@entry=0x7d021b3e0080, ubatch=..., gtype=gtype@entry=LLM_GRAPH_TYPE_DECODER, mctx=<optimized out>, ret=@0x7b821a5d5040: GGML_STATUS_SUCCESS) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-context.cpp:1231
+1231	    const auto status = graph_compute(res->get_gf(), ubatch.n_tokens > 1);
+#20 0x000055e4bcfe6647 in llama_context::decode (this=0x7d021b3e0080, batch_inp=...) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-context.cpp:1692
+1692	        const auto * res = process_ubatch(ubatch, LLM_GRAPH_TYPE_DECODER, mctx.get(), status);
+#21 0x000055e4bcff2dd6 in llama_decode (ctx=<optimized out>, batch=...) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-context.cpp:3747
+3747	    const int ret = ctx->decode(batch);
+#22 0x000055e4bc8a0f70 in test_prompt (ctx=ctx@entry=0x7d021b3e0080, n_prompt=<optimized out>, n_batch=<optimized out>, n_threads=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/tools/llama-bench/llama-bench.cpp:2082
+2082	        int res = llama_decode(ctx, llama_batch_get_one(tokens.data(), n_tokens));
+#23 0x000055e4bc87422a in main (argc=<optimized out>, argv=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/tools/llama-bench/llama-bench.cpp:2306
+2306	                bool res = test_prompt(ctx, t.n_prompt, t.n_batch, t.n_threads);
+[Inferior 1 (process 372935) detached]
+EXIT_CODE=134
+===== mut_san_quick =====
+BIN=/home/nur/am_gguf_lab/repos/llama.cpp/build-huntr-sani/bin/llama-bench
+MODEL=/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/m_00266.gguf
+ARGS=-p 1 -n 1
+warning: sanitizer enabled, performance may be affected
+| model                          |       size |     params | backend    | threads |            test |                  t/s |
+| ------------------------------ | ---------: | ---------: | ---------- | ------: | --------------: | -------------------: |
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+❌️ ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+[New LWP 372826]
+[New LWP 372825]
+[New LWP 372824]
+❌️ warning: process 372823 is already traced by process 372830
+ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+❌️ warning: process 372823 is already traced by process 372830
+ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+
+This GDB supports auto-downloading debuginfo from the following URLs:
+  <https://debuginfod.archlinux.org>
+Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
+Debuginfod has been disabled.
+To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
+[Thread debugging using libthread_db enabled]
+Using host libthread_db library "/usr/lib/libthread_db.so.1".
+0x00007f1803ca0a52 in ?? () from /usr/lib/libc.so.6
+#0  0x00007f1803ca0a52 in ?? () from /usr/lib/libc.so.6
+#1  0x00007f1803c94abc in ?? () from /usr/lib/libc.so.6
+#2  0x00007f1803c94b04 in ?? () from /usr/lib/libc.so.6
+#3  0x00007f1803d05c6f in wait4 () from /usr/lib/libc.so.6
+#4  0x00007f180547fab5 in ?? () from /usr/lib/libasan.so.8
+#5  0x0000564f5262d4e9 in ggml_print_backtrace () at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml.c:234
+234	        waitpid(child_pid, NULL, 0);
+#6  0x0000564f5262d883 in ggml_abort (file=<optimized out>, line=<optimized out>, fmt=0x564f52f58380 "%s: unsupported types: dst: %s, src0: %s, src1: %s\n") at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml.c:268
+268	        ggml_print_backtrace();
+#7  0x0000564f52322c92 in binary_op<op_mul> (params=<optimized out>, dst=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135
+135	        GGML_ABORT("%s: unsupported types: dst: %s, src0: %s, src1: %s\n", __func__,
+#8  ggml_compute_forward_mul (params=params@entry=0x7b1801cac850, dst=dst@entry=0x7b180046d9a0) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:149
+149	    binary_op<op_mul>(params, dst);
+#9  0x0000564f522bd146 in ggml_compute_forward (params=<optimized out>, tensor=0x7b180046d9a0) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:1737
+1737	                ggml_compute_forward_mul(params, tensor);
+#10 ggml_graph_compute_thread (data=data@entry=0x7ce802de3c80) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:3049
+3049	            ggml_compute_forward(&params, node);
+#11 0x0000564f522c2a7e in ggml_graph_compute._omp_fn.0 () at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:3335
+3335	            ggml_graph_compute_thread(&threadpool->workers[ith]);
+#12 0x00007f18053be909 in GOMP_parallel () from /usr/lib/libgomp.so.1
+#13 0x0000564f522cb293 in ggml_graph_compute (cgraph=<optimized out>, cplan=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:3319
+3319	        #pragma omp parallel num_threads(n_threads)
+#14 0x0000564f52147771 in ggml_backend_cpu_graph_compute (backend=<optimized out>, cgraph=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.cpp:190
+190	    return ggml_graph_compute(cgraph, &cplan);
+#15 0x0000564f526c8d15 in ggml_backend_graph_compute_async (backend=<optimized out>, cgraph=0x7d3802de3208) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-backend.cpp:452
+452	    return backend->iface.graph_compute(backend, cgraph);
+#16 ggml_backend_sched_compute_splits (sched=0x7cb802de1280) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-backend.cpp:1678
+1678	            enum ggml_status ec = ggml_backend_graph_compute_async(split_backend, &split->graph);
+#17 ggml_backend_sched_graph_compute_async (sched=0x7cb802de1280, graph=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-backend.cpp:1901
+1901	    return ggml_backend_sched_compute_splits(sched);
+#18 0x0000564f50eb18c2 in llama_context::graph_compute (this=this@entry=0x7c9802de0080, gf=<optimized out>, batched=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-context.cpp:2191
+2191	    auto status = ggml_backend_sched_graph_compute_async(sched.get(), gf);
+#19 0x0000564f50ed39c0 in llama_context::process_ubatch (this=this@entry=0x7c9802de0080, ubatch=..., gtype=gtype@entry=LLM_GRAPH_TYPE_DECODER, mctx=<optimized out>, ret=@0x7b1801fd5040: GGML_STATUS_SUCCESS) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-context.cpp:1231
+1231	    const auto status = graph_compute(res->get_gf(), ubatch.n_tokens > 1);
+#20 0x0000564f50ef8647 in llama_context::decode (this=0x7c9802de0080, batch_inp=...) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-context.cpp:1692
+1692	        const auto * res = process_ubatch(ubatch, LLM_GRAPH_TYPE_DECODER, mctx.get(), status);
+#21 0x0000564f50f04dd6 in llama_decode (ctx=<optimized out>, batch=...) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-context.cpp:3747
+3747	    const int ret = ctx->decode(batch);
+#22 0x0000564f507b2f70 in test_prompt (ctx=ctx@entry=0x7c9802de0080, n_prompt=<optimized out>, n_batch=<optimized out>, n_threads=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/tools/llama-bench/llama-bench.cpp:2082
+2082	        int res = llama_decode(ctx, llama_batch_get_one(tokens.data(), n_tokens));
+#23 0x0000564f5078622a in main (argc=<optimized out>, argv=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/tools/llama-bench/llama-bench.cpp:2306
+2306	                bool res = test_prompt(ctx, t.n_prompt, t.n_batch, t.n_threads);
+[Inferior 1 (process 372823) detached]
+EXIT_CODE=134
+===== seed_rel_deep =====
+BIN=/home/nur/am_gguf_lab/repos/llama.cpp/build-huntr-clean-rel/bin/llama-bench
+MODEL=/home/nur/am_gguf_lab/full_model_seeds/TinyLLama-v0-Q2_K.gguf
+ARGS=-p 256 -n 128
+| model                          |       size |     params | backend    | threads |            test |                  t/s |
+| ------------------------------ | ---------: | ---------: | ---------- | ------: | --------------: | -------------------: |
+| llama ?B Q2_K - Medium         |   3.44 MiB |     4.62 M | CPU        |       4 |           pp256 |   12216.20 ± 1982.62 |
+| llama ?B Q2_K - Medium         |   3.44 MiB |     4.62 M | CPU        |       4 |           tg128 |       1265.19 ± 4.14 |
+
+build: 9f5f0e689 (9080)
+EXIT_CODE=0
+===== seed_rel_quick =====
+BIN=/home/nur/am_gguf_lab/repos/llama.cpp/build-huntr-clean-rel/bin/llama-bench
+MODEL=/home/nur/am_gguf_lab/full_model_seeds/TinyLLama-v0-Q2_K.gguf
+ARGS=-p 1 -n 1
+| model                          |       size |     params | backend    | threads |            test |                  t/s |
+| ------------------------------ | ---------: | ---------: | ---------- | ------: | --------------: | -------------------: |
+| llama ?B Q2_K - Medium         |   3.44 MiB |     4.62 M | CPU        |       4 |             pp1 |      1327.99 ± 17.08 |
+| llama ?B Q2_K - Medium         |   3.44 MiB |     4.62 M | CPU        |       4 |             tg1 |       1335.17 ± 9.10 |
+
+build: 9f5f0e689 (9080)
+EXIT_CODE=0
+===== seed_san_deep =====
+BIN=/home/nur/am_gguf_lab/repos/llama.cpp/build-huntr-sani/bin/llama-bench
+MODEL=/home/nur/am_gguf_lab/full_model_seeds/TinyLLama-v0-Q2_K.gguf
+ARGS=-p 256 -n 128
+warning: sanitizer enabled, performance may be affected
+| model                          |       size |     params | backend    | threads |            test |                  t/s |
+| ------------------------------ | ---------: | ---------: | ---------- | ------: | --------------: | -------------------: |
+| llama ?B Q2_K - Medium         |   3.44 MiB |     4.62 M | CPU        |       4 |           pp256 |     2755.72 ± 132.32 |
+| llama ?B Q2_K - Medium         |   3.44 MiB |     4.62 M | CPU        |       4 |           tg128 |       781.32 ± 54.37 |
+
+build: 9f5f0e689 (9080)
+EXIT_CODE=0
+===== seed_san_quick =====
+BIN=/home/nur/am_gguf_lab/repos/llama.cpp/build-huntr-sani/bin/llama-bench
+MODEL=/home/nur/am_gguf_lab/full_model_seeds/TinyLLama-v0-Q2_K.gguf
+ARGS=-p 1 -n 1
+warning: sanitizer enabled, performance may be affected
+| model                          |       size |     params | backend    | threads |            test |                  t/s |
+| ------------------------------ | ---------: | ---------: | ---------- | ------: | --------------: | -------------------: |
+| llama ?B Q2_K - Medium         |   3.44 MiB |     4.62 M | CPU        |       4 |             pp1 |       583.45 ± 64.80 |
+| llama ?B Q2_K - Medium         |   3.44 MiB |     4.62 M | CPU        |       4 |             tg1 |       702.63 ± 45.55 |
+
+build: 9f5f0e689 (9080)
+EXIT_CODE=0

VERIFY_VERDICT.txt

@@ -0,0 +1,89 @@
+===== V14 VERDICT =====
+VERDICT=CONFIRMED_RELEASE_CRASH_AFTER_LOAD_CANDIDATE
+SEED_RELEASE_OK=1
+MUTANT_RELEASE_NONZERO=1
+MUTANT_LOAD_REJECT=0
+MUTANT_LOADED_SIGNAL=1
+MEMORY_SIGNAL=0
+SANITIZER_SIGNAL=1
+
+MUTANT=/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/m_00266.gguf
+MUTANT_SHA256=0032a33e78fde8347bd7106d3b14702f3045b17643b10bc4ca61ad1eceb7219a
+
+===== EXIT CODES =====
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:EXIT_CODE=0
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:EXIT_CODE=0
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:EXIT_CODE=0
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:EXIT_CODE=0
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_rel_deep.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_rel_quick.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_deep.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_quick.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/seed_rel_deep.txt:EXIT_CODE=0
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/seed_rel_quick.txt:EXIT_CODE=0
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/seed_san_deep.txt:EXIT_CODE=0
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/seed_san_quick.txt:EXIT_CODE=0
+
+===== MUTATION LABEL =====
+/home/nur/am_gguf_lab/huntr_runs/gguf_v10_typeconf_20260510_095020/mutants/manifest.tsv:268:266	/home/nur/am_gguf_lab/huntr_runs/gguf_v10_typeconf_20260510_095020/mutants/m_00266.gguf	TYPE_t49_blk.5.attn_norm.weight_0_to_26	0032a33e78fde8347bd7106d3b14702f3045b17643b10bc4ca61ad1eceb7219a
+/home/nur/am_gguf_lab/huntr_runs/gguf_v10_typeconf_20260510_095020/mutants/queue.tsv:268:266	/home/nur/am_gguf_lab/huntr_runs/gguf_v10_typeconf_20260510_095020/mutants/m_00266.gguf	TYPE_t49_blk.5.attn_norm.weight_0_to_26
+
+===== REAL SIGNALS, TEXT LOGS ONLY =====
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:42:❌️ Unable to attach: program terminated with signal SIGABRT, Aborted.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:46:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:77:  <https://debuginfod.archlinux.org>
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:78:Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:79:Debuginfod has been disabled.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:80:To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:123:[Inferior 1 (process 372585) detached]
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:125:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:158:  <https://debuginfod.archlinux.org>
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:159:Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:160:Debuginfod has been disabled.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:161:To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:207:[Inferior 1 (process 372935) detached]
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:208:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:240:  <https://debuginfod.archlinux.org>
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:241:Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:242:Debuginfod has been disabled.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:243:To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:289:[Inferior 1 (process 372823) detached]
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:290:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_quick.txt:32:  <https://debuginfod.archlinux.org>
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_quick.txt:33:Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_quick.txt:34:Debuginfod has been disabled.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_quick.txt:35:To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_quick.txt:81:[Inferior 1 (process 372823) detached]
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_quick.txt:82:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/cmake_clean_rel.log:3:-- Detecting C compiler ABI info
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/cmake_clean_rel.log:4:-- Detecting C compiler ABI info - done
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/cmake_clean_rel.log:8:-- Detecting CXX compiler ABI info
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/cmake_clean_rel.log:9:-- Detecting CXX compiler ABI info - done
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/cmake_clean_rel.log:13:CMAKE_BUILD_TYPE=RelWithDebInfo
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_deep.txt:33:  <https://debuginfod.archlinux.org>
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_deep.txt:34:Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_deep.txt:35:Debuginfod has been disabled.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_deep.txt:36:To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_deep.txt:82:[Inferior 1 (process 372935) detached]
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_deep.txt:83:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_rel_quick.txt:31:  <https://debuginfod.archlinux.org>
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_rel_quick.txt:32:Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_rel_quick.txt:33:Debuginfod has been disabled.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_rel_quick.txt:34:To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_rel_quick.txt:77:[Inferior 1 (process 372585) detached]
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_rel_quick.txt:79:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/build_clean_rel.log:3:[  0%] Building CXX object common/CMakeFiles/llama-common-base.dir/build-info.cpp.o
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/VERDICT.txt:18:/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/VERDICT.txt:19:/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/VERDICT.txt:20:/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/VERDICT.txt:21:/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/ALL_LOGS.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/VERDICT.txt:22:/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_rel_deep.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/VERDICT.txt:23:/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_rel_quick.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/VERDICT.txt:24:/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_deep.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/VERDICT.txt:25:/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_san_quick.txt:EXIT_CODE=134
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_rel_deep.txt:24:❌️ Unable to attach: program terminated with signal SIGABRT, Aborted.
+/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/mut_rel_deep.txt:28:EXIT_CODE=134

m_00266_typeconf_postload_binaryop_abort.gguf

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0032a33e78fde8347bd7106d3b14702f3045b17643b10bc4ca61ad1eceb7219a
+size 4372832

mut_rel.txt

@@ -0,0 +1,80 @@
+===== mut_rel =====
+BIN=/home/nur/am_gguf_lab/repos/llama.cpp/build-huntr-clean-rel/bin/llama-bench
+MODEL=/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/m_00266.gguf
+ARGS=-p 1 -n 1
+
+| model                          |       size |     params | backend    | threads |            test |                  t/s |
+| ------------------------------ | ---------: | ---------: | ---------- | ------: | --------------: | -------------------: |
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+❌️ ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+❌️ ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+[New LWP 606945]
+[New LWP 606944]
+[New LWP 606943]
+❌️ warning: process 606942 is already traced by process 606949
+ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+
+This GDB supports auto-downloading debuginfo from the following URLs:
+  <https://debuginfod.archlinux.org>
+Enable debuginfod for this session? (y or [n]) [answered N; input not from terminal]
+Debuginfod has been disabled.
+To make this setting permanent, add 'set debuginfod enabled off' to .gdbinit.
+[Thread debugging using libthread_db enabled]
+Using host libthread_db library "/usr/lib/libthread_db.so.1".
+0x00007fea0e0a0a52 in ?? () from /usr/lib/libc.so.6
+#0  0x00007fea0e0a0a52 in ?? () from /usr/lib/libc.so.6
+#1  0x00007fea0e094abc in ?? () from /usr/lib/libc.so.6
+#2  0x00007fea0e094b04 in ?? () from /usr/lib/libc.so.6
+#3  0x00007fea0e105c6f in wait4 () from /usr/lib/libc.so.6
+#4  0x0000563a02fd6a9b in ggml_print_backtrace () at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml.c:234
+234	        waitpid(child_pid, NULL, 0);
+#5  0x0000563a02fd6c28 in ggml_abort (file=0x563a030bfd78 "/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp", line=135, fmt=0x563a030bfdc0 "%s: unsupported types: dst: %s, src0: %s, src1: %s\n") at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml.c:268
+268	        ggml_print_backtrace();
+#6  0x0000563a02f79f74 in binary_op<op_mul> (params=<optimized out>, dst=0x563a42c4ecb0) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135
+135	        GGML_ABORT("%s: unsupported types: dst: %s, src0: %s, src1: %s\n", __func__,
+#7  ggml_compute_forward_mul (params=0x7fffbb6fd2f0, dst=dst@entry=0x563a42c4ecb0) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:149
+149	    binary_op<op_mul>(params, dst);
+#8  0x0000563a02f717b5 in ggml_compute_forward (params=0x7fffbb6fd2f0, tensor=0x563a42c4ecb0) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:1737
+1737	                ggml_compute_forward_mul(params, tensor);
+#9  ggml_graph_compute_thread (data=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:3049
+3049	            ggml_compute_forward(&params, node);
+#10 0x00007fea0eef1909 in GOMP_parallel () from /usr/lib/libgomp.so.1
+#11 0x0000563a02f72da5 in ggml_graph_compute (cgraph=0x563a42814008, cplan=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.c:3319
+3319	        #pragma omp parallel num_threads(n_threads)
+#12 0x0000563a02f3b6d5 in ggml_backend_cpu_graph_compute (backend=<optimized out>, cgraph=0x563a42814008) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/ggml-cpu.cpp:190
+190	    return ggml_graph_compute(cgraph, &cplan);
+#13 0x0000563a02ff169d in ggml_backend_graph_compute_async (backend=<optimized out>, cgraph=0x563a42814008) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-backend.cpp:452
+452	    return backend->iface.graph_compute(backend, cgraph);
+#14 ggml_backend_sched_compute_splits (sched=0x563a427dd550) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-backend.cpp:1678
+1678	            enum ggml_status ec = ggml_backend_graph_compute_async(split_backend, &split->graph);
+#15 ggml_backend_sched_graph_compute_async (sched=0x563a427dd550, graph=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-backend.cpp:1901
+1901	    return ggml_backend_sched_compute_splits(sched);
+#16 0x0000563a02dd0240 in llama_context::graph_compute (this=this@entry=0x563a427b4d60, gf=0x563a42c33b30, batched=<optimized out>) at /usr/include/c++/16.1.1/bits/unique_ptr.h:192
+192	      pointer    _M_ptr() const noexcept { return std::get<0>(_M_t); }
+#17 0x0000563a02dd20e4 in llama_context::process_ubatch (this=this@entry=0x563a427b4d60, ubatch=..., gtype=gtype@entry=LLM_GRAPH_TYPE_DECODER, mctx=mctx@entry=0x563a427b04c0, ret=@0x7fffbb702ec4: 32767) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-graph.h:648
+648	    ggml_cgraph  * get_gf()  const { return gf; }
+#18 0x0000563a02dd90b2 in llama_context::decode (this=0x563a427b4d60, batch_inp=...) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-context.cpp:1692
+1692	        const auto * res = process_ubatch(ubatch, LLM_GRAPH_TYPE_DECODER, mctx.get(), status);
+#19 0x0000563a02ddaa7e in llama_decode (ctx=<optimized out>, batch=...) at /home/nur/am_gguf_lab/repos/llama.cpp/src/llama-context.cpp:3747
+3747	    const int ret = ctx->decode(batch);
+#20 0x0000563a02d0cb7e in test_prompt (ctx=ctx@entry=0x563a427b4d60, n_prompt=1, n_batch=2048, n_threads=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/tools/llama-bench/llama-bench.cpp:2082
+2082	        int res = llama_decode(ctx, llama_batch_get_one(tokens.data(), n_tokens));
+#21 0x0000563a02d06321 in main (argc=<optimized out>, argv=<optimized out>) at /home/nur/am_gguf_lab/repos/llama.cpp/tools/llama-bench/llama-bench.cpp:2306
+2306	                bool res = test_prompt(ctx, t.n_prompt, t.n_batch, t.n_threads);
+[Inferior 1 (process 606942) detached]
+timeout: the monitored command dumped core
+
+EXIT_CODE=134

mut_san.txt

@@ -0,0 +1,30 @@
+===== mut_san =====
+BIN=/home/nur/am_gguf_lab/repos/llama.cpp/build-huntr-sani-hard/bin/llama-bench
+MODEL=/home/nur/am_gguf_lab/huntr_runs/verify_candidate_v14_20260510_101604/m_00266.gguf
+ARGS=-p 1 -n 1
+
+warning: sanitizer enabled, performance may be affected
+| model                          |       size |     params | backend    | threads |            test |                  t/s |
+| ------------------------------ | ---------: | ---------: | ---------- | ------: | --------------: | -------------------: |
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+/home/nur/am_gguf_lab/repos/llama.cpp/ggml/src/ggml-cpu/binary-ops.cpp:135: binary_op: unsupported types: dst: f32, src0: f32, src1: i32
+
+❌️ ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+❌️ ptrace: Operation not permitted.
+❌️ No stack.
+❌️ The program is not being run.
+
+EXIT_CODE=134
+❌️ ptrace: No such process.
+❌️ No stack.
+❌️ The program is not being run.
+❌️ ptrace: No such process.
+❌️ No stack.
+❌️ The program is not being run.