The report
Two inference requests can carry different logical cache keys while referring to the same physical memory allocation. SGLang issue #49361 describes how a streaming session could arrive in that state after a later turn changed the cache namespace and was aborted. The resulting allocator behavior threatens cross-request isolation even though the prefix-cache tree appears to separate namespaces.
Logical names did not pin memory ownership
A session initially holds a KV row associated with one namespace, derived from request keys such as cache_salt or adapter identity. A later turn can change that namespace, including when new media content changes a derived salt. The streaming-session path reuses the old row without comparing the namespace, and an aborted turn may checkpoint the same physical KV slots under the later key. Those slots are then referenced by two distinct cache nodes.
Evicting one node can return the memory to the allocator while the other node still refers to it. A new request may receive the returned slot, after which a prefix hit against the surviving node can consume state belonging to the new request. Further eviction can propagate the ownership error. The Case deliberately distinguishes this mechanism from a confirmed prompt or secret appearing in another customer's output.
What remains to prove
The reporter proposed binding the session to an immutable cache namespace while it borrows slots. At the checked source revision, the change was proposed rather than a confirmed released fix. Reproduction should demonstrate real cross-principal output contamination under an actual multi-tenant deployment, then verify allocation identities and cleanup across aborts, eviction and adapter changes. The issue is serious because it concerns physical ownership, but its title does not substitute for evidence of a field exfiltration event.