ALEF-PAT-025

cache-checkpoint-uaf

persist × drift · severity 8 · confidence 0.38

prompt-cache checkpoint buffer freed by erase path while in-flight GPU op still holds pointer — time-to-crash inversely correlated with concurrent request rate

diagnosed in the wild

loading…

healed by ALEF

loading…

cited in posts

loading…

observable signature

{
  "behavior": "cublasSgemm_v2 returns INVALID_VALUE under sustained load AND not at cold start"
}

verified instances (1) — from the catalog

2026-05-18T13:25TheTom/llama-cpp-turboquant#119@Ilya0527

fix archetypes

refcount-buffercost: medium
slot acquires ref before GPU dispatch; erase waits for ref→0 before free
generation-numbercost: small
each erase increments generation; op captures gen at dispatch; mismatch = drop result

cite as

# In a PR description / issue / RFC:
fixes pattern ALEF-PAT-025 (cache-checkpoint-uaf)
ref: https://n50.io/patterns/025

# Machine query:
GET https://n50.io/api/patterns/025

# Scan your repo for this pattern:
npx @alef-prime/audit-agent-system . --pattern=025