CRASH_PROVEN.md

Dynamic proof — koboldcpp legacy ggml loaders unchecked n_dims → ne[2] stack overflow

Reproduced 2026-07-04. Isolates the loop shared by koboldcpp's legacy ggml loaders, e.g. otherarch/gpt2_v2.cpp:269-273:

int32_t ne[2] = {1,1};
for (int i = 0; i < n_dims; ++i) { fin.read(&ne[i], sizeof(ne[i])); nelements *= ne[i]; }

n_dims is read straight from the model file with no n_dims <= 2 check.

Run + crash (-O0; real code's fin.read writes are non-elidable)

c++ -O0 -g -fstack-protector-all ndims_repro.cpp -o ndims_repro
./ndims_repro 100000
* stop reason = EXC_BAD_ACCESS (code=1, address=0x16fe00000)
    frame #0: main at ndims_repro.cpp:18   ; ne[i] = 0x41414141   (== fin.read(&ne[i], ...))
exit=139 (SIGSEGV)

n_dims>=3 writes attacker bytes past the 2-element stack array; a large n_dims sweeps down the stack until the guard page -> SIGSEGV.

Affected loaders (same pattern, ne[2] + unchecked n_dims)

otherarch/gpt2_v1.cpp, gpt2_v2.cpp, gpt2_v3.cpp, gptj_v1.cpp, gptj_v2.cpp, gptj_v3.cpp, mpt_v3.cpp, llama_v2.cpp, llama_v3.cpp, neox_v2.cpp, neox_v3.cpp, rwkv_v2.cpp — selected by koboldcpp's FileFormat detection (gpttype_adapter.cpp) when loading a legacy-format model.