ggml GGUF loader allows integer overflow and enum UB
Fuzzing found two paths where malformed model tensors trigger undefined behavior before validation finishes.
By tensor#fuzzing
PyTorch batch-norm stats update overruns undersized tensors
The CPU path indexes running mean and variance by channel count without checking buffer length, causing heap out-of-bounds access.
By tensor