[BUG: Breaking] vLLM EngineCore crashes with SIGSEGV (`realloc(): invalid pointer` / `EngineCore: -11`) during startup when loading `datalab-to/surya-ocr-2`

Model loading took 1.41 GiB memory
Setting attention block size...
Padding mamba page size...
Encoder cache will be initialized with a budget of 6144 tokens...
realloc(): invalid pointer

RuntimeError: Engine core initialization failed.
Failed core proc(s): {'EngineCore': -11}

WARNING 07-28 06:46:23 [argparse_utils.py:257] With `vllm serve`, you should provide the model as a positional argument or in a config file instead of via the `--model` option. The `--model` option will be removed in a future version.
(APIServer pid=1) INFO 07-28 06:46:23 [utils.py:299] 
(APIServer pid=1) INFO 07-28 06:46:23 [utils.py:299]        █     █     █▄   ▄█
(APIServer pid=1) INFO 07-28 06:46:23 [utils.py:299]  ▄▄ ▄█ █     █     █ ▀▄▀ █  version 0.20.1
(APIServer pid=1) INFO 07-28 06:46:23 [utils.py:299]   █▄█▀ █     █     █     █  model   datalab-to/surya-ocr-2
(APIServer pid=1) INFO 07-28 06:46:23 [utils.py:299]    ▀▀  ▀▀▀▀▀ ▀▀▀▀▀ ▀     ▀
(APIServer pid=1) INFO 07-28 06:46:23 [utils.py:299] 
(APIServer pid=1) INFO 07-28 06:46:23 [utils.py:233] non-default args: {'model_tag': 'datalab-to/surya-ocr-2', 'model': 'datalab-to/surya-ocr-2', 'dtype': 'bfloat16', 'max_model_len': 18000, 'enforce_eager': True, 'served_model_name': ['datalab-to/surya-ocr-2'], 'gpu_memory_utilization': 0.25, 'enable_prefix_caching': True, 'mm_processor_kwargs': {'min_pixels': 3136, 'max_pixels': 6291456}, 'max_num_batched_tokens': 4096, 'max_num_seqs': 16, 'speculative_config': {'method': 'mtp', 'num_speculative_tokens': 2}}
(APIServer pid=1) Warning: You are sending unauthenticated requests to the HF Hub. Please set a HF_TOKEN to enable higher rate limits and faster downloads.
(APIServer pid=1) INFO 07-28 06:46:31 [nixl_utils.py:20] Setting UCX_RCACHE_MAX_UNRELEASED to '1024' to avoid a rare memory leak in UCX when using NIXL.
(APIServer pid=1) INFO 07-28 06:46:31 [nixl_utils.py:32] NIXL is available
(APIServer pid=1) INFO 07-28 06:46:31 [model.py:555] Resolved architecture: Qwen3_5ForConditionalGeneration
(APIServer pid=1) INFO 07-28 06:46:31 [model.py:1680] Using max model len 18000

(APIServer pid=1) INFO 07-28 06:46:36 [model.py:555] Resolved architecture: Qwen3_5MTP
(APIServer pid=1) INFO 07-28 06:46:36 [model.py:1680] Using max model len 262144
(APIServer pid=1) WARNING 07-28 06:46:36 [speculative.py:602] Enabling num_speculative_tokens > 1 will run multiple times of forward on same MTP layer,which may result in lower acceptance rate
(APIServer pid=1) INFO 07-28 06:46:36 [scheduler.py:239] Chunked prefill is enabled with max_num_batched_tokens=4096.
(APIServer pid=1) WARNING 07-28 06:46:36 [config.py:367] Mamba cache mode is set to 'align' for Qwen3_5ForConditionalGeneration by default when prefix caching is enabled
(APIServer pid=1) INFO 07-28 06:46:36 [config.py:387] Warning: Prefix caching in Mamba cache 'align' mode is currently enabled. Its support for Mamba layers is experimental. Please report any issues you may observe.
(APIServer pid=1) INFO 07-28 06:46:36 [vllm.py:840] Asynchronous scheduling is enabled.
(APIServer pid=1) WARNING 07-28 06:46:36 [vllm.py:896] Enforce eager set, disabling torch.compile and CUDAGraphs. This is equivalent to setting -cc.mode=none -cc.cudagraph_mode=none
(APIServer pid=1) WARNING 07-28 06:46:36 [vllm.py:914] Inductor compilation was disabled by user settings, optimizations settings that are only active during inductor compilation will be ignored.
(APIServer pid=1) INFO 07-28 06:46:36 [kernel.py:205] Final IR op priority after setting platform defaults: IrOpPriorityConfig(rms_norm=['vllm_c', 'native'])
(APIServer pid=1) WARNING 07-28 06:46:36 [vllm.py:1402] max_num_scheduled_tokens is set to 4096 based on the speculative decoding settings. This may lead to suboptimal performance. Consider increasing max_num_batched_tokens to accommodate the additional draft token slots, or decrease num_speculative_tokens or max_num_seqs.
(APIServer pid=1) INFO 07-28 06:46:36 [vllm.py:1089] Cudagraph is disabled under eager mode
(APIServer pid=1) INFO 07-28 06:46:36 [compilation.py:303] Enabled custom fusions: norm_quant, act_quant
(APIServer pid=1) [transformers] `Qwen2VLImageProcessorFast` is deprecated. The `Fast` suffix for image processors has been removed; use `Qwen2VLImageProcessor` instead.
(APIServer pid=1) [transformers] The `use_fast` parameter is deprecated and will be removed in a future version. Use `backend="torchvision"` instead of `use_fast=True`, or `backend="pil"` instead of `use_fast=False`.
(EngineCore pid=263) INFO 07-28 06:46:51 [core.py:109] Initializing a V1 LLM engine (v0.20.1) with config: model='datalab-to/surya-ocr-2', speculative_config=SpeculativeConfig(method='mtp', model='datalab-to/surya-ocr-2', num_spec_tokens=2), tokenizer='datalab-to/surya-ocr-2', skip_tokenizer_init=False, tokenizer_mode=auto, revision=None, tokenizer_revision=None, trust_remote_code=False, dtype=torch.bfloat16, max_seq_len=18000, download_dir=None, load_format=auto, tensor_parallel_size=1, pipeline_parallel_size=1, data_parallel_size=1, decode_context_parallel_size=1, dcp_comm_backend=ag_rs, disable_custom_all_reduce=False, quantization=None, quantization_config=None, enforce_eager=True, enable_return_routed_experts=False, kv_cache_dtype=auto, device_config=cuda, structured_outputs_config=StructuredOutputsConfig(backend='auto', disable_any_whitespace=False, disable_additional_properties=False, reasoning_parser='', reasoning_parser_plugin='', enable_in_reasoning=False), observability_config=ObservabilityConfig(show_hidden_metrics_for_version=None, otlp_traces_endpoint=None, collect_detailed_traces=None, kv_cache_metrics=False, kv_cache_metrics_sample=0.01, cudagraph_metrics=False, enable_layerwise_nvtx_tracing=False, enable_mfu_metrics=False, enable_mm_processor_stats=False, enable_logging_iteration_details=False), seed=0, served_model_name=datalab-to/surya-ocr-2, enable_prefix_caching=True, enable_chunked_prefill=True, pooler_config=None, compilation_config={'mode': <CompilationMode.NONE: 0>, 'debug_dump_path': None, 'cache_dir': '', 'compile_cache_save_format': 'binary', 'backend': 'inductor', 'custom_ops': ['all'], 'ir_enable_torch_wrap': False, 'splitting_ops': [], 'compile_mm_encoder': False, 'cudagraph_mm_encoder': False, 'encoder_cudagraph_token_budgets': [], 'encoder_cudagraph_max_vision_items_per_batch': 0, 'encoder_cudagraph_max_frames_per_batch': None, 'compile_sizes': [], 'compile_ranges_endpoints': [4096], 'inductor_compile_config': {'enable_auto_functionalized_v2': False, 'size_asserts': False, 'alignment_asserts': False, 'scalar_asserts': False, 'combo_kernels': True, 'benchmark_combo_kernel': True}, 'inductor_passes': {}, 'cudagraph_mode': <CUDAGraphMode.NONE: 0>, 'cudagraph_num_of_warmups': 0, 'cudagraph_capture_sizes': [], 'cudagraph_copy_inputs': False, 'cudagraph_specialize_lora': True, 'use_inductor_graph_partition': False, 'pass_config': {'fuse_norm_quant': True, 'fuse_act_quant': True, 'fuse_attn_quant': False, 'enable_sp': False, 'fuse_gemm_comms': False, 'fuse_allreduce_rms': False}, 'max_cudagraph_capture_size': 0, 'dynamic_shapes_config': {'type': <DynamicShapesType.BACKED: 'backed'>, 'evaluate_guards': False, 'assume_32_bit_indexing': False}, 'local_cache_dir': None, 'fast_moe_cold_start': False, 'static_all_moe_layers': []}, kernel_config=KernelConfig(ir_op_priority=IrOpPriorityConfig(rms_norm=['vllm_c', 'native']), enable_flashinfer_autotune=True, moe_backend='auto')
(EngineCore pid=263) INFO 07-28 06:46:51 [nixl_utils.py:32] NIXL is available
(EngineCore pid=263) [transformers] `Qwen2VLImageProcessorFast` is deprecated. The `Fast` suffix for image processors has been removed; use `Qwen2VLImageProcessor` instead.
(EngineCore pid=263) Warning: You are sending unauthenticated requests to the HF Hub. Please set a HF_TOKEN to enable higher rate limits and faster downloads.
(EngineCore pid=263) INFO 07-28 06:46:54 [parallel_state.py:1402] world_size=1 rank=0 local_rank=0 distributed_init_method=tcp://172.17.0.3:44033 backend=nccl
(EngineCore pid=263) INFO 07-28 06:46:54 [parallel_state.py:1715] rank 0 in world size 1 is assigned as DP rank 0, PP rank 0, PCP rank 0, TP rank 0, EP rank N/A, EPLB rank N/A
(EngineCore pid=263) WARNING 07-28 06:46:55 [__init__.py:206] min_p and logit_bias parameters won't work with speculative decoding.
(EngineCore pid=263) [transformers] The `use_fast` parameter is deprecated and will be removed in a future version. Use `backend="torchvision"` instead of `use_fast=True`, or `backend="pil"` instead of `use_fast=False`.
(EngineCore pid=263) INFO 07-28 06:47:05 [gpu_model_runner.py:4777] Starting to load model datalab-to/surya-ocr-2...
(EngineCore pid=263) INFO 07-28 06:47:05 [cuda.py:423] Using backend AttentionBackendEnum.FLASH_ATTN for vit attention
(EngineCore pid=263) INFO 07-28 06:47:05 [mm_encoder_attention.py:230] Using AttentionBackendEnum.FLASH_ATTN for MMEncoderAttention.
(EngineCore pid=263) INFO 07-28 06:47:05 [gdn_linear_attn.py:153] Using Triton/FLA GDN prefill kernel
(EngineCore pid=263) INFO 07-28 06:47:05 [cuda.py:368] Using FLASH_ATTN attention backend out of potential backends: ['FLASH_ATTN', 'FLASHINFER', 'TRITON_ATTN', 'FLEX_ATTENTION'].
(EngineCore pid=263) INFO 07-28 06:47:05 [flash_attn.py:646] Using FlashAttention version 2
(EngineCore pid=263) INFO 07-28 06:47:06 [weight_utils.py:659] No model.safetensors.index.json found in remote.
(EngineCore pid=263) INFO 07-28 06:47:06 [weight_utils.py:904] Filesystem type for checkpoints: EXT4. Checkpoint size: 1.28 GiB. Available RAM: 55.79 GiB.
(EngineCore pid=263) INFO 07-28 06:47:06 [weight_utils.py:927] Auto-prefetch is disabled because the filesystem (EXT4) is not a recognized network FS (NFS/Lustre). If you want to force prefetching, start vLLM with --safetensors-load-strategy=prefetch.
Loading safetensors checkpoint shards:   0% Completed | 0/1 [00:00<?, ?it/s]
Loading safetensors checkpoint shards: 100% Completed | 1/1 [00:00<00:00,  7.33it/s]
Loading safetensors checkpoint shards: 100% Completed | 1/1 [00:00<00:00,  7.33it/s]
(EngineCore pid=263) 
(EngineCore pid=263) INFO 07-28 06:47:06 [default_loader.py:384] Loading weights took 0.15 seconds
(EngineCore pid=263) INFO 07-28 06:47:06 [gpu_model_runner.py:4801] Loading drafter model...
(EngineCore pid=263) INFO 07-28 06:47:07 [weight_utils.py:659] No model.safetensors.index.json found in remote.
(EngineCore pid=263) INFO 07-28 06:47:07 [weight_utils.py:904] Filesystem type for checkpoints: EXT4. Checkpoint size: 1.28 GiB. Available RAM: 55.78 GiB.
Loading safetensors checkpoint shards:   0% Completed | 0/1 [00:00<?, ?it/s]
Loading safetensors checkpoint shards: 100% Completed | 1/1 [00:00<00:00, 48.03it/s]
(EngineCore pid=263) 
(EngineCore pid=263) INFO 07-28 06:47:07 [default_loader.py:384] Loading weights took 0.02 seconds
(EngineCore pid=263) INFO 07-28 06:47:07 [llm_base_proposer.py:1445] Detected MTP model. Sharing target model embedding weights with the draft model.
(EngineCore pid=263) INFO 07-28 06:47:07 [llm_base_proposer.py:1501] Detected MTP model. Sharing target model lm_head weights with the draft model.
(EngineCore pid=263) INFO 07-28 06:47:07 [gpu_model_runner.py:4879] Model loading took 1.41 GiB memory and 1.902940 seconds
(EngineCore pid=263) INFO 07-28 06:47:07 [interface.py:606] Setting attention block size to 544 tokens to ensure that attention page size is >= mamba page size.
(EngineCore pid=263) INFO 07-28 06:47:07 [interface.py:630] Padding mamba page size by 0.37% to ensure that mamba page size and attention page size are exactly equal.
(EngineCore pid=263) INFO 07-28 06:47:07 [gpu_model_runner.py:5820] Encoder cache will be initialized with a budget of 6144 tokens, and profiled with 1 image items of the maximum feature size.
!!!!!!! Segfault encountered !!!!!!!
  File "<unknown>", line 0, in realloc
  File "<unknown>", line 0, in llvm::SmallVectorBase<unsigned int>::grow_pod(void*, unsigned long, unsigned long)
  File "<unknown>", line 0, in llvm::MachineInstrExpressionTrait::getHashValue(llvm::MachineInstr const* const&)
  File "<unknown>", line 0, in llvm::MachineInstrExpressionTrait::getHashValue(llvm::MachineInstr const* const&)
  File "<unknown>", line 0, in bool llvm::DenseMapBase<llvm::DenseMap<llvm::MachineInstr*, llvm::ScopedHashTableVal<llvm::MachineInstr*, unsigned int>*, llvm::MachineInstrExpressionTrait, llvm::detail::DenseMapPair<llvm::MachineInstr*, llvm::ScopedHashTableVal<llvm::MachineInstr*, unsigned int>*> >, llvm::MachineInstr*, llvm::ScopedHashTableVal<llvm::MachineInstr*, unsigned int>*, llvm::MachineInstrExpressionTrait, llvm::detail::DenseMapPair<llvm::MachineInstr*, llvm::ScopedHashTableVal<llvm::MachineInstr*, unsigned int>*> >::LookupBucketFor<llvm::MachineInstr*>(llvm::MachineInstr* const&, llvm::detail::DenseMapPair<llvm::MachineInstr*, llvm::ScopedHashTableVal<llvm::MachineInstr*, unsigned int>*>*&)
  File "<unknown>", line 0, in llvm::ScopedHashTableScope<llvm::MachineInstr*, unsigned int, llvm::MachineInstrExpressionTrait, llvm::RecyclingAllocator<llvm::BumpPtrAllocatorImpl<llvm::MallocAllocator, 4096ul, 4096ul, 128ul>, llvm::ScopedHashTableVal<llvm::MachineInstr*, unsigned int>, 32ul, 8ul> >::~ScopedHashTableScope()
  File "<unknown>", line 0, in (anonymous namespace)::MachineCSEImpl::ExitScope(llvm::MachineBasicBlock*)
  File "<unknown>", line 0, in (anonymous namespace)::MachineCSEImpl::run(llvm::MachineFunction&)
  File "<unknown>", line 0, in (anonymous namespace)::MachineCSELegacy::runOnMachineFunction(llvm::MachineFunction&)
  File "<unknown>", line 0, in llvm::MachineFunctionPass::runOnFunction(llvm::Function&)
  File "<unknown>", line 0, in llvm::FPPassManager::runOnFunction(llvm::Function&)
  File "<unknown>", line 0, in llvm::FPPassManager::runOnModule(llvm::Module&)
  File "<unknown>", line 0, in llvm::legacy::PassManagerImpl::run(llvm::Module&)
  File "/project/python/src/llvm.cc", line 371, in translateLLVMIRToASM(llvm::Module&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > > const&, bool, bool)
  File "/project/python/src/llvm.cc", line 674, in init_triton_llvm(pybind11::module_&&)::$_14::operator()(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, bool, bool) const
  File "/tmp/build-env-grbvi_xi/lib/python3.12/site-packages/pybind11/include/pybind11/cast.h", line 2137, in pybind11::object pybind11::detail::argument_loader<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, bool, bool>::call_impl<pybind11::object, init_triton_llvm(pybind11::module_&&)::$_14&, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul, pybind11::detail::void_type>(init_triton_llvm(pybind11::module_&&)::$_14&, std::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul, 4ul, 5ul, 6ul>, pybind11::detail::void_type&&) &&
  File "/tmp/build-env-grbvi_xi/lib/python3.12/site-packages/pybind11/include/pybind11/cast.h", line 2105, in std::enable_if<!std::is_void<pybind11::object>::value, pybind11::object>::type pybind11::detail::argument_loader<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, bool, bool>::call<pybind11::object, pybind11::detail::void_type, init_triton_llvm(pybind11::module_&&)::$_14&>(init_triton_llvm(pybind11::module_&&)::$_14&) &&
  File "/tmp/build-env-grbvi_xi/lib/python3.12/site-packages/pybind11/include/pybind11/pybind11.h", line 430, in pybind11::cpp_function::initialize<init_triton_llvm(pybind11::module_&&)::$_14, pybind11::object, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::vector<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > > >, bool, bool, pybind11::name, pybind11::scope, pybind11::sibling, pybind11::return_value_policy>(init_triton_llvm(pybind11::module_&&)::$_14&&, pybind11::object (*)(std::__cxx11::basic_string<char, std::char_traits<char>, s