Instructions to use salvepilo/llama-cpp-gemma3-divzero-poc with libraries, inference providers, notebooks, and local apps. Follow these links to get started.

Libraries

How to use salvepilo/llama-cpp-gemma3-divzero-poc with llama-cpp-python:

# !pip install llama-cpp-python

from llama_cpp import Llama

llm = Llama.from_pretrained(
	repo_id="salvepilo/llama-cpp-gemma3-divzero-poc",
	filename="poc_gemma3_divzero.gguf",
)

output = llm(
	"Once upon a time,",
	max_tokens=512,
	echo=True
)
print(output)

Notebooks
Google Colab
Kaggle
Local Apps Settings

llama.cpp

How to use salvepilo/llama-cpp-gemma3-divzero-poc with llama.cpp:

Install (macOS, Linux)

curl -LsSf https://llama.app/install.sh | sh
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf salvepilo/llama-cpp-gemma3-divzero-poc
# Run inference directly in the terminal:
llama cli -hf salvepilo/llama-cpp-gemma3-divzero-poc

Install from WinGet (Windows)

winget install llama.cpp
# Start a local OpenAI-compatible server with a web UI:
llama serve -hf salvepilo/llama-cpp-gemma3-divzero-poc
# Run inference directly in the terminal:
llama cli -hf salvepilo/llama-cpp-gemma3-divzero-poc

Use pre-built binary

# Download pre-built binary from:
# https://github.com/ggerganov/llama.cpp/releases
# Start a local OpenAI-compatible server with a web UI:
./llama-server -hf salvepilo/llama-cpp-gemma3-divzero-poc
# Run inference directly in the terminal:
./llama-cli -hf salvepilo/llama-cpp-gemma3-divzero-poc

Build from source code

git clone https://github.com/ggerganov/llama.cpp.git
cd llama.cpp
cmake -B build
cmake --build build -j --target llama-server llama-cli
# Start a local OpenAI-compatible server with a web UI:
./build/bin/llama-server -hf salvepilo/llama-cpp-gemma3-divzero-poc
# Run inference directly in the terminal:
./build/bin/llama-cli -hf salvepilo/llama-cpp-gemma3-divzero-poc

Use Docker

docker model run hf.co/salvepilo/llama-cpp-gemma3-divzero-poc

LM Studio
Jan
Ollama
How to use salvepilo/llama-cpp-gemma3-divzero-poc with Ollama:
```
ollama run hf.co/salvepilo/llama-cpp-gemma3-divzero-poc
```

Unsloth Studio

How to use salvepilo/llama-cpp-gemma3-divzero-poc with Unsloth Studio:

Install Unsloth Studio (macOS, Linux, WSL)

curl -fsSL https://unsloth.ai/install.sh | sh
# Run unsloth studio
unsloth studio -H 0.0.0.0 -p 8888
# Then open http://localhost:8888 in your browser
# Search for salvepilo/llama-cpp-gemma3-divzero-poc to start chatting

Install Unsloth Studio (Windows)

irm https://unsloth.ai/install.ps1 | iex
# Run unsloth studio
unsloth studio -H 0.0.0.0 -p 8888
# Then open http://localhost:8888 in your browser
# Search for salvepilo/llama-cpp-gemma3-divzero-poc to start chatting

Using HuggingFace Spaces for Unsloth

# No setup required
# Open https://huggingface.co/spaces/unsloth/studio in your browser
# Search for salvepilo/llama-cpp-gemma3-divzero-poc to start chatting

Atomic Chat new
Docker Model Runner
How to use salvepilo/llama-cpp-gemma3-divzero-poc with Docker Model Runner:
```
docker model run hf.co/salvepilo/llama-cpp-gemma3-divzero-poc
```

Lemonade

How to use salvepilo/llama-cpp-gemma3-divzero-poc with Lemonade:

Pull the model

# Download Lemonade from https://lemonade-server.ai/
lemonade pull salvepilo/llama-cpp-gemma3-divzero-poc

Run and chat with the model

lemonade run user.llama-cpp-gemma3-divzero-poc-{{QUANT_TAG}}

List all available models

lemonade list

llama.cpp Gemma3 Integer Division-by-Zero PoC

Proof-of-concept for a division-by-zero vulnerability in llama.cpp's Gemma3 architecture loader.

Vulnerable file: src/models/gemma3.cpp:32

Files

poc_gemma3_divzero.gguf — 235-byte malicious GGUF (no tensors, triggers SIGFPE on x86_64)
reproducer.cpp — standalone C++ reproducer (no llama.cpp build needed)

Quick test

# Standalone (no llama.cpp needed)
g++ -o reproducer reproducer.cpp -fsanitize=undefined -fno-sanitize-recover=all
./reproducer
# Expected: runtime error: division by zero

# With llama.cpp
./llama-cli -m poc_gemma3_divzero.gguf -p 'hello'
# Expected on x86_64: Floating point exception (exit 136)

Root cause

When block_count=62 (→ LLM_TYPE_27B) and attention.head_count is absent from the GGUF, n_head(0) returns 0 and the expression n_embd / n_head(0) is integer division-by-zero.

Reported via Huntr bug bounty program.

Downloads last month: 17

GGUF

Model size

0 params

Architecture

gemma3

Hardware compatibility

We're not able to determine the quantization variants.

View all variants

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support