# koboldcpp Legacy GGML Loader PoC

## Vulnerability
CWE-121 Stack Buffer Overflow + CWE-190 Integer Overflow in all 10 legacy model loaders.

## Target
LostRuins/koboldcpp - otherarch/*.cpp

## Usage
```
python3 generate_poc.py
```
This generates:
- poc_stack_oob.bin - triggers stack buffer overflow via n_dims=8 on ne[2]
- poc_int_overflow.bin - triggers integer overflow via n_embd=46341

## Reproduction
```
make LLAMA_SANITIZE_ADDRESS=1
./koboldcpp --model poc_stack_oob.bin
```
ASan will report stack-buffer-overflow in the ne[2] write loop.

## Affected Files
All share identical vulnerable pattern (int32_t ne[2] with unbounded n_dims loop):
- otherarch/gpt2_v1.cpp
- otherarch/gpt2_v2.cpp
- otherarch/gpt2_v3.cpp
- otherarch/gptj_v1.cpp
- otherarch/gptj_v2.cpp
- otherarch/gptj_v3.cpp
- otherarch/neox_v2.cpp
- otherarch/neox_v3.cpp
- otherarch/mpt_v3.cpp
- otherarch/rwkv_v2.cpp