A prefill worker posts an asynchronous RDMA write into a decoding-side cache slot. If a canceled request releases that slot before the write has completed or drained, another request can inherit the same address and receive stale data. The SGLang report describes posted RDMA writes surviving abort and writing into recycled KV-cache storage in a…
Inspect the ClaimsCase · DiggingBeagle record
SGLang asynchronous RDMA transfers could overwrite a newly assigned user cache
The SGLang team demonstrated a separate cache corruption race when unfinished RDMA transfers outlived an aborted request.
Scope
The lab corruption mechanism is related to but not identical with Cloudflare’s 155-response production event; those response counts must not be assigned to the RDMA reproduction.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
The SGLang team reproduces stale RDMA writes into recycled KV slots with two H200 GPUs and describes deferred release/transfer safeguards. This is a distinct cancellation-lifetime bug from the GLM-5.3 production rejection-path incident; a production victim count is not supplied. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-003-A · CLM-CP22-003-B · CLM-ENRICH-20261028-014 · SGLang disaggregated-prefill KV-cache transfer safety research
At a glance
Field prevalence and exact patched-version coverage across each transfer backend remain to be independently tested. The SGLang team has not supplied evidence that the RDMA cancellation reproduction generated the 155 Cloudflare GLM-5.3 production responses.
Limits and uncertaintyFull account
A prefill worker posts an asynchronous RDMA write into a decoding-side cache slot. If a canceled request releases that slot before the write has completed or drained, another request can inherit the same address and receive stale data.
The SGLang report describes posted RDMA writes surviving abort and writing into recycled KV-cache storage in a disaggregated-prefill/decode deployment. The authors reproduced cross-request cache corruption with a controlled two-H200 setup and describe affected transfer backends including Mooncake, NIXL and MORI. Primary evidence.
The lab corruption mechanism is related to but not identical with Cloudflare’s 155-response production event; those response counts must not be assigned to the RDMA reproduction.
Drain or cancel posted writes before recycling cache slots; bind a generation or owner token to allocated cache memory and regression-test abort and reassignment races.
Claims & evidence
CLM-CP22-003-AThe SGLang report describes posted RDMA writes surviving abort and writing into recycled KV-cache storage in a disaggregated-prefill/decode deployment.supported
Basis: reported finding
- supportsSGLang disaggregated-prefill KV-cache transfer safety researchprimary disclosure
Technical analysis; RDMA transfer cancellation and slot reuse
CLM-CP22-003-BThe authors reproduced cross-request cache corruption with a controlled two-H200 setup and describe affected transfer backends including Mooncake, NIXL and MORI.supported
Basis: reported finding
- supportsSGLang disaggregated-prefill KV-cache transfer safety researchprimary disclosure
Reproduction; Two-GPU experiment and transfer backends
CLM-ENRICH-20261028-014SGLang describes deferred cache-slot release until outstanding transfers finish, combined with earlier rejection/admission checks. The RDMA cancellation reproduction is not the same event as Cloudflare’s 155 production responses.supported
Basis: reported finding
- supportsSGLang disaggregated-prefill KV-cache transfer safety researchprimary disclosure
Related KV cache lifetime issues; Deferred Release; Immediate remediation and upstream fix
Controls and mitigations
- Drain or cancel posted writes before recycling cache slots; bind a generation or owner token to allocated cache memory and regression-test abort and reassignment races.
Unknowns and contradictions
- Field prevalence and exact patched-version coverage across each transfer backend remain to be independently tested.
- The SGLang team has not supplied evidence that the RDMA cancellation reproduction generated the 155 Cloudflare GLM-5.3 production responses.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199