Memory-safety checking on devices

Memcheck can report supported invalid or misaligned device accesses, CUDA API errors, and leaks when the relevant checking options are enabled. An access within a large underlying allocation can still violate a smaller tensor view’s logical bounds without crossing an allocation boundary visible to the checker. Keep shape and stride assertions in the application as well as tool runs. Precise reports depend on supported instructions, compilation information, and tool compatibility; preserve the actual command, binary, driver, toolkit, and GPU identity for reproduction.

Racecheck targets supported on-chip shared-memory hazards; it is not a universal detector of global-memory races between devices or arbitrary host threads. Initcheck in the stated release supports the documented address-space selection: global checking is the default, while shared-memory checking is selected with --initcheck-address-space shared, or both spaces with all. That shared capability was introduced in a later release and must not be projected onto every older tool. Synccheck identifies supported synchronization misuse, but a clean report is not a proof of all progress, barrier, or memory-order properties.

For a contiguous tensor, derive both the element index and the accessed byte interval. A valid first byte is insufficient if a vectorized access extends beyond the end. For views, include offset, stride, element width, and allocation extent rather than reusing a contiguous-array proof. Test empty and small shapes through the appropriate launch policy, nonmultiples of block size, and dimensions that change vectorization or shared-memory participation. Use index types that cannot overflow at supported problem sizes before an otherwise correct bounds comparison.

Run memory-access checks before interpreting other tool findings, because an earlier corruption can produce misleading later symptoms. Then select the checks relevant to the program, including shared-memory initialization and synchronization where supported. Instrumentation changes timing and can add substantial overhead, so do not use sanitized runs as normal throughput measurements. It also cannot inspect every host memory access outside its CUDA-related coverage. Release notes identify capability changes and known limitations; compatibility is part of the experiment rather than an assumed constant.

Construct adversarial but valid inputs that exercise boundary tiles, different strides, repeated buffer reuse, and concurrent streams. Check numeric outputs against a trusted implementation, because an in-bounds access to the wrong tensor element may satisfy the memory checker while violating the algorithm. A passing run reports no covered violation in that execution; it does not prove every possible interleaving or untested shape safe. Treat nondeterministic failures as evidence to investigate rather than accepting a later passing run as a correction.

The probability lab models only a deliberately assumed input-trigger probability. Reset, set probability to 0.1 and trials to 10, predict the chance of at least one trigger, then Step. Its exact binomial distribution is not a stream of sanitizer executions and says nothing about detector sensitivity. Independent identical trigger probabilities are a hypothesis, often unrealistic for correlated test shapes. Use the model to question coverage claims, not to infer a real kernel’s bug probability or certify correctness.