AIKIDO-2026-177724

TL;DR

The XML tool-calling schema converter wraps unconstrained string properties with redundant formatting-whitespace repetitions around the string value, so a run of whitespace produces a linear number of active Earley parser states and a quadratic rollback history. A grammar built from an XML tool-calling style schema with an unconstrained string, combined with model output containing many whitespace characters, drives unbounded parser state and memory growth. The cumulative Compact2DArray CSR offset can then overflow int32_t, feeding an invalid parser state into the scan path and causing a SIGSEGV in Release builds alongside extreme memory consumption. The fix omits the redundant whitespace rules for unconstrained XML strings and adds always-on pre-mutation bounds checks that raise a controlled error before the compact array offsets become unrepresentable.