This issue comes from a Codex global scan of deepmodeling/deepmd-kit at commit 73de44b1f94471b2e3bdb6b11f57b34d7bc791bb.

Problem

The Paddle C++ API builds send_list as one pointer address per communication swap, but reshapes the Paddle tensor to the total number of atoms sent.

In DeepPotPD, send_list is reshaped with total_send:

• deepmd-kit/source/api_cc/src/DeepPotPD.cc

  Lines 443 to 446 in 73de44b

  	assert(sizeof(std::intptr_t) == 8);
  	int total_send = std::accumulate(eff_sendnum, eff_sendnum + nswap, 0);
  	sendlist_tensor->Reshape({total_send});

Immediately after that, the code pushes exactly nswap pointer addresses:

• deepmd-kit/source/api_cc/src/DeepPotPD.cc

  Lines 452 to 459 in 73de44b

  	std::vector<std::intptr_t> pointer_addresses;
  	pointer_addresses.reserve(nswap);
  	for (int iswap = 0; iswap < nswap; ++iswap) {
  	std::intptr_t addr =
  	reinterpret_cast<std::intptr_t>(eff_sendlist[iswap]);
  	pointer_addresses.push_back(addr);
  	}
  	sendlist_tensor->CopyFromCpu(pointer_addresses.data());

The Paddle communication op consumes sendlist as an array indexed by iswap, so it expects one pointer address per swap:

• deepmd-kit/source/op/pd/comm.cc

  Lines 142 to 153 in 73de44b

  	for (int iswap = 0; iswap < nswap; ++iswap) {
  	int nrecv = recvnum[iswap];
  	int nsend = sendnum[iswap];
  	paddle::Tensor isendlist;
  	paddle::Tensor send_g1_tensor;
  	FPTYPE* send_g1 = nullptr;
  	if (nsend != 0) {
  	std::intptr_t addr = static_cast<std::intptr_t>(sendlist[iswap]);
  	int* isendlist_ptr = reinterpret_cast<int*>(addr);
  	isendlist =
  	paddle::from_blob(isendlist_ptr, {nsend}, paddle::DataType::INT32,

This makes the tensor shape inconsistent with the buffer copied into it. When total_send > nswap, CopyFromCpu(pointer_addresses.data()) can read past the pointer_addresses vector. When the sizes differ in the other direction, the op can lose pointer entries.

Impact

Paddle inference with LAMMPS-style communication can receive corrupted send_list pointer addresses or trigger out-of-bounds host reads during tensor construction, depending on the communication pattern.

Suggested fix

Reshape sendlist_tensor with {nswap} for the pointer-address tensor, and keep sendnum_tensor as the source of each swap's atom count. Add a communication regression where sum(sendnum) != nswap.