Modern inference systems load model artifacts they did not create. A checkpoint from a model hub, fine-tuning vendor, or conversion pipeline is parsed into tensors and consumed by native C++, CUDA, HIP, and Triton code. Offsets, shapes, block sizes, scale counts, and group indices eventually become allocations, loop bounds, and memory addresses. A file can parse successfully while unsafe relationships between individually valid fields remain unchecked.

This talk maps that boundary across vLLM, SGLang, llama.cpp, TensorFlow Lite, ONNX, and quantization tooling. Through public findings, assigned CVEs, maintainer-merged fixes, and matched negative controls, I show recurring failure patterns involving extent disagreement, cardinality mismatch, and invalid index domains. A public GPTQModel case traces checkpoint-controlled state to an out-of-bounds device read at the production Triton dequantization launcher.

The point is not a crash count. It is a reproducible method for separating source hypotheses, loader reachability, native-sink evidence, and demonstrated impact. Attendees leave with a practical approach for treating model artifacts as untrusted input and auditing the native consumers in their own inference stacks.