Pre-existing latent bug surfaced by compute-sanitizer after the SP15
NULL-pointer fix at 2e37af29d unblocked the cascade. Threads 60-63
were writing past denoise_target_q_buf's end every batch.
Sanitizer evidence (pre-fix on 2e37af29d):
Invalid __global__ write of size 4 bytes
at compute_expected_q+0x2480
by thread (60..63, 0, 0) in block (0, 0, 0)
Access at <addr> is out of bounds (45/97/149/201 bytes after
nearest allocation of size B*12*4 bytes)
Host backtrace: GpuDqnTrainer::compute_denoise_target_q
→ submit_post_aux_ops → run_full_step
Root cause — semantic mismatch between writer stride and buffer size:
- compute_expected_q writes q_values[i*total_actions + a] with
total_actions = b0+b1+b2+b3 = 4+3+3+3 = 13 (4-direction factored)
- denoise_target_q_buf was allocated b*12 (legacy 3+3+3+3 layout)
- threads 60..63 wrote slot 12 of samples (60..63 % batch_size)
past the buffer end every step
The downstream q_denoise_backward + denoise_loss_grad kernels read
Q_target[b * D + i] with hardcoded D=12 because the diffusion denoiser
MLP itself only has 12 output slots (W2[12,24] + b2[12]) — its 12 are
the q_coord_buf's post-cross-branch-attention narrowed output, NOT a
clean subset of the 13 raw Q-actions.
The exact same fix pattern was already applied to the sibling
q_var_buf_trainer allocation in the prior SP4 audit (see comment block
at gpu_dqn_trainer.rs:21620-21630 referencing the identical OOB at
threads 60..63); denoise_target_q_buf 8 lines below was missed because
it was guarded by the SP15 NULL-pointer ILLEGAL_ADDRESS that fault-
stopped the cascade before this OOB could fire — 2e37af29d removed the
upstream ILLEGAL_ADDRESS, surfacing the latent OOB.
Fix architecture (Option A — pad buffer to total_actions, pass stride
to consumer; same pattern as q_var_buf_trainer):
1. Widen denoise_target_q_buf from b*12 to b*total_actions (= b*13)
to match compute_expected_q's writer stride.
2. Add refined_stride / target_stride / input_stride parameters to
q_denoise_backward kernel; the kernel still computes D=12 per-
sample (denoiser MLP fixed width) but addresses each input buffer
at its own per-sample stride.
3. Add refined_stride / target_stride parameters to denoise_loss_grad
kernel (same pattern; used by launch_q_denoise_backward_cublas).
4. Update both Rust launchers (launch_q_denoise_backward,
launch_q_denoise_backward_cublas) to pass refined_stride=12 (q_coord
and q_input are post-attention narrowed),
target_stride=total_actions=13.
5. denoise_q_input_buf STAYS at b*12 — it's a snapshot of q_coord_buf
(also b*12) via snapshot_pre_denoise_q's DtoD copy; never written
by compute_expected_q.
6. Flat-scan consumers (SP4 target_q_p99_update producer + SP3 slot
46 threshold-check + dqn_clamp_finite_f32) UNCHANGED — they
consume the buffer flat via .len(); widening from b*12 to b*13 is
monotone (one more valid Q-value per sample in the histogram).
Atomic per feedback_no_partial_refactor: 2 kernel signatures + buffer
allocation + 2 launch sites + struct doc comments + SP3 slot 46 doc +
audit doc — all in one commit. Every consumer of the writer's stride
migrates simultaneously.
Verification:
- SQLX_OFFLINE=true cargo check -p ml --features cuda: clean
- compute-sanitizer (RTX 3050 Ti): 0 Invalid __global__ errors at
compute_expected_q post-fix (down from 4 per training step in
baseline — re-verified on 2e37af29d to confirm the diff)
- SQLX_OFFLINE=true cargo test -p ml --features cuda --lib: holds
parent baseline 947 pass / 12 fail (same 12 pre-existing failures)
Files touched:
crates/ml/src/cuda_pipeline/experience_kernels.cu
— q_denoise_backward + denoise_loss_grad kernel signatures
crates/ml/src/cuda_pipeline/gpu_dqn_trainer.rs
— alloc widen + 2 launcher updates + 4 doc comment updates
docs/dqn-wire-up-audit.md
— audit entry
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
23e9a1f78c