A header that claims two tensors share the same bytes

A safetensors file's header is a JSON object mapping each tensor name to a dtype, a shape, and a data_offsets [start, end) pair into the data section that follows. Nothing in the format requires those ranges to be disjoint — that's an invariant every well-behaved writer maintains, but a parser has to actually check for, not assume.

We took a clean 4-tensor file and hand-edited the header: blk.0.attn_k.weight's declared data_offsets now starts 4 bytes into blk.0.attn_q.weight's declared range. The underlying bytes weren't moved — this is a pure metadata-level inconsistency, which is precisely the point: a file's own header is asserting something about itself that isn't true.

Two tensors whose declared regions overlap can be made to alias the same underlying memory during load — a route to reading one tensor's data as another's, or corrupting one by writing what's meant for the other. The scanner computes real start/end intervals from the header and checks every adjacent pair for overlap, catching this at CRITICAL before the file is ever loaded into a runtime.