The report
An aborted inference request does not necessarily mean its GPU memory is free to reuse. The SGLang team demonstrated that pending RDMA writes can continue after cancellation and reach a KV-cache slot already assigned to a later request. The consequence is cross-request memory corruption in a disaggregated prefill/decode architecture. The documented race.
Cancellation and memory release are different events
When an asynchronous transfer has been posted, cancelling its parent request cannot retroactively withdraw every write. If the system immediately recycles the destination slot, completion of the old transfer can overwrite the new owner's state. SGLang reports a deterministic reproduction using two H200 GPUs, with exposure considered across Mooncake, NIXL and MORI transfer paths. This is a controlled two-machine demonstration, not a measured deployment-wide leak rate. Reproduction evidence.
The disclosed repair delays releasing cache slots until outstanding transfers complete; accompanying changes address admission and rejection behavior. Such controls are lifecycle guarantees rather than content filters. They must survive cancellation, reconnects and errors at precisely the points when normal request accounting is already incomplete. SGLang's technical report.
Cloudflare's GLM-5.3 service separately disclosed 155 contaminated production responses. The public material does not show that those responses were caused by this RDMA race. One incident demonstrates a customer-visible failure in request admission; the other establishes an independent mechanism involving post-cancellation memory writes. The distinction matters when validating fixes: a cache-size correction cannot substitute for draining in-flight transfers.