FA-98631 / KV cache position mapping / Open access

Reused slot handles reject stale generations · case 01

A handle from a prior owner resolves to a newly reused slot.

Verified by executionVariant 1 · 6 checks per implementationDownload source bundle ↓JSON ↗

ROOT CAUSE

Slot identity is checked without validating its generation counter.

THE FAILURE

Slot identity is checked without validating its generation counter.

Unsuccessful approach: Checking generation alone accepts a handle whose slot number belongs to another owner.

Case contract

A handle (slot,generation) is valid only when live maps slot to that generation; return its slot or -1.

Why this case matters

A small in-memory model makes the cache address contract explicit for a serving component.

1 / The failure

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(live_generations, handle):
    return handle[0] if handle[0] in live_generations else -1
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
live={2:N,5:N+1}
check('current handle',solve(live,[2,N]),2)
check('stale generation',solve(live,[2,N-1]),-1)
check('wrong slot same generation',solve(live,[7,N]),-1)
check('second live slot',solve(live,[5,N+1]),5)
check('empty live table',solve({},[0,0]),-1)
check('slot zero',solve({0:3},[0,3]),0)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
current handle	`2`	`2`	Passed
stale generation	`2`	`-1`	Failed
wrong slot same generation	`-1`	`-1`	Passed
second live slot	`5`	`5`	Passed
empty live table	`-1`	`-1`	Passed
slot zero	`0`	`0`	Passed

SHA-256 / 6b88644daae389aca7ff12a9367b20465f69824cfafdbb24f3ae98f631ac3d60

2 / The unsuccessful fix

Exit 1

"""Failure Map reference implementation. Python standard library only."""
import json

N = 1
observations = []
def solve(live_generations, handle):
    return handle[0] if handle[1] in live_generations.values() else -1
def check(label, actual, expected):
    observations.append({"check": label, "actual": actual, "expected": expected, "passed": actual == expected})
live={2:N,5:N+1}
check('current handle',solve(live,[2,N]),2)
check('stale generation',solve(live,[2,N-1]),-1)
check('wrong slot same generation',solve(live,[7,N]),-1)
check('second live slot',solve(live,[5,N+1]),5)
check('empty live table',solve({},[0,0]),-1)
check('slot zero',solve({0:3},[0,3]),0)
print(json.dumps({"observations": observations, "passed": all(x["passed"] for x in observations)}, ensure_ascii=False))
raise SystemExit(0 if all(x["passed"] for x in observations) else 1)

Boundary fixture	Actual	Expected	Outcome
current handle	`2`	`2`	Passed
stale generation	`-1`	`-1`	Passed
wrong slot same generation	`7`	`-1`	Failed
second live slot	`5`	`5`	Passed
empty live table	`-1`	`-1`	Passed
slot zero	`0`	`0`	Passed

SHA-256 / 9db62cbf8165f742320854f14d27fa6671f3258c0601df40f5739e9f3da28a6c

HELD IN THE MEMBER ARCHIVE

The verified repair and its recorded checks are member-only.

This mechanism has 6 recorded checks per implementation. The open-access tier publishes the failure and the unsuccessful fix; the repaired source that passes every check, and the observations that prove it, are available to members.

Every case sharing this mechanism uses the same contract and the same repair, so this one record is held back for all of them.

Member access is invitation-based. Sign in with your invited account to inspect the repair.

Verification & scope

These toy integer maps omit tensor layout, concurrency, device memory, and model-specific cache formats. This reproducer isolates one failure mechanism. Results cover the supplied fixtures. Variants within a family share a test contract and should remain grouped when constructing evaluation splits. Related mechanisms with a shared evaluation_group must also remain together; these controlled models are not independent production incidents.

Observations recorded using Python 3.12.14 at 2026-09-30T16:48:14.972342+00:00.

Case digest / 5eecfcbca121079dad615737638561da8967c32e1a064eddcb7e49a1a4c4ab35