triton 3.9.0

Source: https://github.com/triton-lang/triton
Tag scanned: v3.9.0
Compared with: v3.8.0 (19 signals introduced since)
Files: 1344 scanned, 445 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 3 warn · 46 info
Scan time: 46.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 46 of 46 warn and critical signals; 43 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-28 07:13

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

warn dynamic-execution .github/workflows/integration-tests-amd.yml:350:14 new in this release

[embedded bash] command name is a variable (`$ROCJITSU`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
$ROCJITSU python3 -c "import triton; print(triton.runtime.driver.active.get_current_target())"
```
inconclusive LLM, confidence 0.50 A CI step runs python3 through a ROCJITSU-variable wrapper to print the Triton active target.
Reasoning
The command name comes from a ROCJITSU variable set elsewhere in the workflow. It is plausibly a ROCm JIT tool path used to query the Triton target, but the snippet does not show where the variable is set, so the purpose is unclear.
warn dynamic-execution .github/workflows/integration-tests-amd.yml:360:13 new in this release

[embedded bash] command name is a variable (`$ROCM_ROOT`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
            shift 2
            "$ROCM_ROOT/bin/mirage" run --in-process \
              --config "$ROCJITSU_CONFIG" \
              --cpu-thread-budget "$budget" -- \
```
inconclusive LLM, confidence 0.50 A CI step runs a mirage binary from ROCM_ROOT with a JIT config and CPU budget.
Reasoning
The command is a path under ROCM_ROOT, which is a normal ROCm install location, invoking a mirage binary with a config file and thread budget. The binary and config origin are not shown, so the snippet alone cannot settle whether it is legitimate.
warn dynamic-execution .github/workflows/integration-tests-amd.yml:400:13 new in this release

[embedded bash] command name is a variable (`$ROCM_ROOT`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
            shift 2
            "$ROCM_ROOT/bin/mirage" run --in-process \
              --config "$ROCJITSU_CONFIG" \
              --cpu-thread-budget "$budget" -- \
```
inconclusive LLM, confidence 0.50 A second CI step runs the same ROCM_ROOT mirage binary with a JIT config.
Reasoning
This is a duplicate of the step at line 360, with the same ROCM_ROOT mirage invocation. The same uncertainty about the binary and its config applies.
info ~~warn~~ → info by review dynamic-execution .github/amd-ci/runner-diagnostics.sh:8:3 new in this release

command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)
```
  echo "+ $*"
  "$@" 2>&1 || true
}
```
likely benign LLM, confidence 0.90 A shell helper that echoes and runs the command it is given, used for CI diagnostics.
Reasoning
The "$@" is a log-and-run helper that echoes its arguments and runs them, which is the usual CI wrapper pattern. The commands come from the workflow's own scripts, so nothing here is hidden.

info high-complexity .github/workflows/integration-tests-amd.yml:392:19 new in this release

[embedded bash] compression ratio 0.654 is >2σ above file mean 0.574 (raw pass, confidence 0.50)

          k_core="not (test_load_store_same_ptr or test_atomic_cas or (test_scan2d and shape365) or (test_scan2d and shape869) or (test_scaled_dot and 128-64-128-True-False-False-e2m1-e4m3-4-16-1))"

info ~~warn~~ → info by review encoding-base64 docs/meetups/for_moderators/README.md:37:139 new in this release

base64-like blob (124 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
Meetup"](https://calendar.google.com/calendar/u/0?cid=MDVhM2U3NjgwNWEwNTJmNDAwODYyMzJmNzNhNmIxYzk2MWViOTE3YTRjZjIzNDgxMDZhYjcwNmEwOWU2MGE4Y0Bncm91cC5jYWxlbmRhci5nb29nbGUuY29t). people should be able to add this calendar to their calendars so they'll see future events when they're available.
```
likely benign LLM, confidence 0.90 A base64-encoded Google Calendar ID in a meetup calendar link.
Reasoning
The blob is the cid parameter of a Google Calendar URL, a base64 encoding of the calendar ID. It is a standard calendar link, not a payload.
info ~~warn~~ → info by review identifier-confusable-collision lib/Dialect/TritonNvidiaGPU/IR/Dialect.cpp:62:47 new in this release

two identifiers collapse to visual skeleton `||` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
                        triton::CacheModifier cacheModifier,
                        CacheEvictionPriority l1, CacheEvictionPriority primary,
                        CacheEvictionPriority secondary, FloatAttr fraction,
                        IntegerAttr prefetchSize) {
```
dismissed LLM, confidence 0.80 Ordinary C++ parameter names that the confusable check collapses to the same skeleton.
Reasoning
The collision comes from short C++ identifiers such as l1, primary and secondary that look alike under a visual skeleton. This is a common false positive of the token pass in a compiler codebase, and the snippet shows ordinary parameter names.
info ~~warn~~ → info by review dynamic-execution python/triton/_compile_warmup_pool.py:149:20 new in this release

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        if function.__code__.co_name != function.__name__:
            code = compile(jit_function.src, function.__name__, "exec")
            namespace = {**globals_, **function.__globals__}
            exec(code, namespace)
```
likely benign LLM, confidence 0.88 compile and exec of a JIT function's source to rebuild it for warmup.
Reasoning
The warmup pool recompiles a JIT function's own source with its globals so kernels can be compiled in worker processes. This is the expected mechanism for a JIT compiler.
info ~~warn~~ → info by review dynamic-execution python/triton/_compile_warmup_pool.py:151:13 new in this release

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
            namespace = {**globals_, **function.__globals__}
            exec(code, namespace)
            global_names = _extract_code_globals(namespace[function.__name__].__code__)
            for global_name in global_names:
```
likely benign LLM, confidence 0.88 exec of a recompiled JIT function source in a namespace.
Reasoning
The exec runs the compiled source of a @triton.jit function into a namespace, which is the same expected JIT rebuild step as the adjacent compile call.
info ~~warn~~ → info by review dynamic-execution python/triton/_compile_warmup_pool.py:215:12 new in this release

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
        source = ASTSource(function, signature, constants, attrs)
    return compile(source, target=target, options=serialized_options)
```
likely benign LLM, confidence 0.88 Triton compile of an ASTSource into a kernel.
Reasoning
This compile call turns an ASTSource and serialized options into a compiled kernel. It is the core compiler entry point, not a payload decoder.
info ~~warn~~ → info by review dynamic-import third_party/amd/include/hipblas_instance.h:77:11 new in this release

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
      dylibHandle =
          dlopen(libraryPath.c_str(), RTLD_NOLOAD | RTLD_LOCAL | RTLD_LAZY);
    }
    if (dylibHandle == nullptr) {
```
likely benign LLM, confidence 0.85 Reuses or loads the hipBLAS shared library via dlopen.
Reasoning
RTLD_NOLOAD reuse then load of hipBLAS library; ordinary dynamic library handling for a GPU backend.
info ~~warn~~ → info by review dynamic-import third_party/amd/include/hipblas_instance.h:81:21 new in this release

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
      // If not found, try to load it
      dylibHandle = dlopen(libraryPath.c_str(), RTLD_LOCAL | RTLD_LAZY);
    }
    if (dylibHandle == nullptr) {
```
likely benign LLM, confidence 0.85 Fallback dlopen of the hipBLAS library path.
Reasoning
Fallback load of the same hipBLAS library; standard pattern.
info ~~warn~~ → info by review dynamic-import third_party/proton/csrc/include/Driver/Dispatch.h:115:16 new in this release

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
        // First reuse the existing handle
        *lib = dlopen(libraryName.c_str(), RTLD_NOLOAD);
        if (*lib == nullptr) {
          // If not found, try to load it from LD_LIBRARY_PATH
```
likely benign LLM, confidence 0.85 Reuses or loads a driver library by name.
Reasoning
RTLD_NOLOAD reuse followed by standard load of a named driver library; legitimate.
info ~~warn~~ → info by review dynamic-import third_party/proton/csrc/include/Driver/Dispatch.h:118:18 new in this release

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
          // If not found, try to load it from LD_LIBRARY_PATH
          *lib = dlopen(libraryName.c_str(), RTLD_LOCAL | RTLD_LAZY);
        }
      }
```
likely benign LLM, confidence 0.85 Fallback dlopen of a driver library via library search path.
Reasoning
Fallback load from LD_LIBRARY_PATH for driver library; standard behavior.
info ~~warn~~ → info by review dynamic-import third_party/proton/csrc/lib/Profiler/RocprofSDK/RocprofSDKProfiler.cpp:61:18 new in this release

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
std::string findLoadedLibPath(const char *libName, const char *symbolName) {
  void *handle = dlopen(libName, RTLD_NOLOAD | RTLD_LAZY);
  if (!handle)
    return "";
```
likely benign LLM, confidence 0.85 Checks for an already-loaded library by name without loading it.
Reasoning
Checks whether a library is already loaded using RTLD_NOLOAD; no fetch or execution of untrusted content.
info ~~warn~~ → info by review dynamic-attribute third_party/proton/csrc/lib/Profiler/RocprofSDK/RocprofSDKProfiler.cpp:66:22 new in this release

`dlsym` called with a non-literal symbol name (ast pass, confidence 0.75)
```
  std::string path;
  if (void *symbol = dlsym(handle, symbolName)) {
    Dl_info info;
    if (dladdr(symbol, &info) && info.dli_fname)
```
likely benign LLM, confidence 0.90 Runtime symbol resolution via dlsym followed by dladdr to locate the providing shared library.
Reasoning
dlsym with a variable symbol name is a normal way to resolve ROCm profiler SDK entry points at runtime; the code then uses dladdr to find the providing library path, which is profiler plumbing rather than malicious. Dynamic symbol lookup in a GPU profiler backend is expected.
info ~~warn~~ → info by review dynamic-import third_party/proton/csrc/lib/Profiler/RocprofSDK/RocprofSDKProfiler.cpp:97:16 new in this release

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
      std::string fullPath = libDir + "/" + libName;
      handle = dlopen(fullPath.c_str(), RTLD_NOW | RTLD_GLOBAL);
    }
    if (!handle)
```
likely benign LLM, confidence 0.85 Loads the rocprofiler SDK shared library from a constructed directory path.
Reasoning
dlopen of a path built from a library directory and library name is a standard pattern for loading the ROCm profiler SDK from a configured location. No encoding, network, or shell involvement is visible in the snippet.
info ~~warn~~ → info by review dynamic-import third_party/proton/csrc/lib/Profiler/RocprofSDK/RocprofSDKProfiler.cpp:100:16 new in this release

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
    if (!handle)
      handle = dlopen(libName, RTLD_NOW | RTLD_GLOBAL);
    if (std::string(libName) == "librocprofiler-sdk.so")
      sdkHandle = handle;
```
likely benign LLM, confidence 0.85 Fallback loading of the rocprofiler SDK library by name, storing the handle.
Reasoning
Fallback dlopen by bare library name, with the handle saved when the library is librocprofiler-sdk.so. This is ordinary library discovery for a profiler integration.
info ~~warn~~ → info by review dynamic-import third_party/proton/csrc/lib/Profiler/RocprofSDK/RocprofSDKProfiler.cpp:1095:20 new in this release

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
    roctxLibrary = getStrEnv("TRITON_ROCTX_LIBRARY");
  void *roctxLib = dlopen(roctxLibrary.c_str(), RTLD_NOLOAD | RTLD_NOW);
  if (!roctxLib)
    return;
```
likely benign LLM, confidence 0.85 Checks for an already-loaded roctx library whose path is taken from an environment variable.
Reasoning
The roctx library path comes from the TRITON_ROCTX_LIBRARY environment variable and is opened with RTLD_NOLOAD, which only checks whether the library is already loaded. This is a benign configuration hook that does not load new code.
info ~~warn~~ → info by review dynamic-execution docs/conf.py:294:5

`subprocess.run` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
    print(f"Installing Triton Python package using {max_jobs} threads")
    subprocess.run("pip install -e ../", shell=True, env=os.environ.copy())

    setup_generated_mlir_docs()
```
likely benign LLM, confidence 0.90 The Sphinx config runs a literal pip install -e of the repository root.
Reasoning
The shell=True command is a literal pip install of the local package in editable mode, run during Sphinx docs build. This is a normal docs setup step with no untrusted input.
info ~~warn~~ → info by review encoding-base64 docs/meetups/for_moderators/README.md:55:83

base64-like blob (124 bytes, compression ratio 0.98) (raw pass, confidence 0.60)
```
3. Create a Google Calendar event [here](https://calendar.google.com/calendar/u/0?cid=MDVhM2U3NjgwNWEwNTJmNDAwODYyMzJmNzNhNmIxYzk2MWViOTE3YTRjZjIzNDgxMDZhYjcwNmEwOWU2MGE4Y0Bncm91cC5jYWxlbmRhci5nb29nbGUuY29t).
    * Title: "Triton Community Meetup - Month year"
```
likely benign LLM, confidence 0.90 The same base64-encoded Google Calendar ID, repeated in a link for creating events.
Reasoning
This is the same Google Calendar cid link repeated in the moderator instructions, so it is the same benign calendar identifier.
info ~~warn~~ → info by review dynamic-execution examples/plugins/README.md:223:5

[embedded python] `exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    )
    exec(stage_src, module.__dict__)
    make_lambda = lambda f: lambda src, metadata: f(src, metadata, options, capability)
    stages["ttir"] = make_lambda(module.make_ttir)
```
likely benign LLM, confidence 0.70 A plugin tutorial execs a stage source string into a module dict to build compiler stages.
Reasoning
This is a documentation example for a Triton backend plugin that execs generated stage source into a module namespace. The source comes from the plugin's own code, not from attacker input, though exec is a sensitive pattern that deserves a glance.
info ~~warn~~ → info by review identifier-confusable-collision python/src/gluon_ir.cc:56:20

two identifiers collapse to visual skeleton `||` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
  auto outDims = tt::standardOutDimNames(ctx, rank);
  tt::LinearLayout ll(std::move(bases), outDims);
  return ttg::CGAEncodingAttr::get(ctx, std::move(ll));
}
```
dismissed LLM, confidence 0.80 Short C++ identifiers in a layout function that the confusable check flagged.
Reasoning
The flagged identifiers are ordinary short names in a layout-encoding function, and the skeleton collision is a false positive of the token pass. Nothing in the snippet is deceptive.
info ~~warn~~ → info by review dynamic-attribute python/test/unit/language/print_helper.py:175:10

reach-by-name through `globals` (ast pass, confidence 0.60)
```
if __name__ == "__main__":
    fn = globals()[sys.argv[1]]
    fn(*sys.argv[2:])
```
likely benign LLM, confidence 0.90 A test script dispatches to a named test function taken from sys.argv.
Reasoning
This is a test helper that picks a function by name from its command-line argument to run it. It is a standard test dispatch pattern, and the reachable functions are the file's own tests.
info ~~warn~~ → info by review dynamic-execution python/test/unit/language/test_core.py:106:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
            src = src.replace(k, v)
        exec(src, globals(), local_namespace)
        return local_namespace[template.fn.__name__]
    else:
```
likely benign LLM, confidence 0.90 The Triton test suite execs a kernel source generated from a template.
Reasoning
The exec runs source produced by substituting values into a Triton test template. This is a routine way of generating kernels in the test suite, and the source comes from the tests themselves.
info ~~warn~~ → info by review dynamic-execution python/test/unit/language/test_core.py:184:13

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    # reference result
    z_ref = eval(expr if numpy_expr is None else numpy_expr)
    # triton result
    x_tri = to_triton(x, device=device, dst_type=dtype_x)
```
likely benign LLM, confidence 0.85 A test evaluates an expression string to compute a reference result for comparison.
Reasoning
The eval evaluates a test expression string to produce a reference result for comparison with Triton output. The expressions are authored in the test file, so this is a normal numerical test pattern.
info ~~warn~~ → info by review dynamic-execution python/test/unit/language/test_core.py:291:25

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
            with promotion_numpy_2_0():
                z_ref = eval(scalar_expr)
        else:
            z_ref = eval(expr if numpy_expr is None else numpy_expr)
```
likely benign LLM, confidence 0.92 eval of a test expression to compute a NumPy reference result.
Reasoning
The eval runs test-authored expression strings inside a numerical test harness that compares Triton results against NumPy. Nothing in the snippet takes input from outside the test suite.
info ~~warn~~ → info by review dynamic-execution python/test/unit/language/test_core.py:293:21

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        else:
            z_ref = eval(expr if numpy_expr is None else numpy_expr)

        dtype_z = _binary_op_dtype_override(dtype_x, dtype_y)
```
likely benign LLM, confidence 0.92 eval of a test expression to compute a NumPy reference result.
Reasoning
Same test-harness pattern: the eval evaluates a parametrized expression string to build the reference output for comparison.
info ~~warn~~ → info by review dynamic-execution python/test/unit/language/test_core.py:371:21

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
        full_name = f"triton.language.{dtype}"
        assert repr(eval(full_name)) == full_name
```
likely benign LLM, confidence 0.93 eval of a triton.language dtype name in a repr test.
Reasoning
The eval resolves a dtype name under triton.language to check its repr. The input is a fixed dtype string from the test itself.
info ~~warn~~ → info by review dynamic-execution python/test/unit/language/test_core.py:1650:13

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
    y = np.zeros(shape_z, dtype=getattr(np, dtype_str))
    z_ref = eval(expr) + y
    # triton result
    z_tri = to_triton(np.empty_like(z_ref), device=device)
```
likely benign LLM, confidence 0.92 eval of a test expression to compute the expected tensor.
Reasoning
Test harness evaluates a parametrized expression to build the expected result for a Triton kernel comparison.

info whitespace-anomaly python/test/unit/runtime/test_autotuner.py:12:1

file mixes tab and space indentation (48 tab-indented and 487 space-indented lines) (raw pass, confidence 0.40)

def do_bench(kernel_call, quantiles, use_cuda_graph=False):
    if use_cuda_graph:
        return triton.testing.do_bench_cudagraph(kernel_call, quantiles=quantiles)
    return triton.testing.do_bench(kernel_call, quantiles=quantiles, warmup=1, rep=1)

info ~~warn~~ → info by review dynamic-execution python/triton/language/__init__.py:340:22

`eval` called on a non-literal expression (ast pass, confidence 0.70)
```
            from triton.experimental.gluon.language.amd.cdna5.tdm import tensor_descriptor_type as amd_tensor_descriptor_type
            layout = eval(
                layout_str,
                dict(NVMMASharedLayout=NVMMASharedLayout, PaddedSharedLayout=PaddedSharedLayout,
```
likely benign LLM, confidence 0.72 eval of a layout string with a restricted set of Gluon layout classes.
Reasoning
eval runs over a layout string with a restricted namespace of layout classes. The string likely comes from Triton's own layout serialization, though the snippet does not show its source, so a restricted-input concern cannot be fully ruled out.
info ~~warn~~ → info by review dynamic-execution python/triton/runtime/cache.py:289:10

`open(__file__)` — file reads its own source, common pattern for extracting payloads hidden in comments (ast pass, confidence 0.85)
```
    # frontend
    with open(__file__, "rb") as f:
        contents += [hashlib.sha256(f.read()).hexdigest()]
    # compiler
```
likely benign LLM, confidence 0.90 Reads the module's own source to hash it for the compilation cache key.
Reasoning
The code reads its own source file to hash it into the cache key, so a source change invalidates the cache. The finding's payload-extraction message does not match the snippet, which only hashes the bytes.
info ~~warn~~ → info by review dynamic-execution python/triton/runtime/interpreter.py:1654:25

`compile` called on a non-literal expression (ast pass, confidence 0.70)
```
    def _compile_and_exec(self, transformed_ast):
        compiled_code = compile(transformed_ast, filename=self.filename, mode='exec')
        local_namespace = {**self.kwargs}
        fn_globals = self.fn.__globals__
```
likely benign LLM, confidence 0.90 Interpreter compiles a transformed kernel AST for Python execution.
Reasoning
The Triton interpreter compiles a transformed AST of a user kernel so it can run in Python. This is its intended function.
info ~~warn~~ → info by review dynamic-execution python/triton/runtime/interpreter.py:1660:9

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
                fn_globals[key] = value
        exec(compiled_code, fn_globals, local_namespace)
        return local_namespace[self.fn.__name__]
```
likely benign LLM, confidence 0.90 Interpreter execs compiled kernel code in its globals.
Reasoning
This exec runs the interpreter's compiled kernel code in the kernel's own globals, the same intended path as the preceding compile.
info ~~warn~~ → info by review dynamic-execution python/triton/runtime/jit.py:462:5

`exec` called on a non-literal expression (ast pass, confidence 0.70)
```
    # Execute the function string in func_namespace to create the function
    exec(func_body, func_namespace)

    # Extract the newly created function from the namespace
```
likely benign LLM, confidence 0.85 JIT execs generated function body text to create a kernel function.
Reasoning
The JIT generates a function from a source string and execs it into a namespace to build the kernel. The generated body comes from the compiler's own code generation, not an external payload.
info ~~critical~~ → info by review dynamic-execution python/triton_kernels/triton_kernels/specialize.py:55:5

`exec` called on a constructed string (ast pass, confidence 0.80)
```
    exec_globals.update({"stored_functions": stored_functions})
    exec(src + "\n\nstored_functions.append(" + function_name + ")\n", exec_globals)

    f.__signature__ = inspect.signature(stored_functions[0])
```
likely benign LLM, confidence 0.80 exec of a specialized function source built from a kernel's own source.
Reasoning
This builds a function from the source of an existing function plus a fixed append line, then execs it to specialize its signature. The critical severity reflects the exec of a constructed string, but the constructed content is the kernel's own source with a fixed suffix.
info ~~warn~~ → info by review frame-introspection python/tutorials/07-extern-functions.py:79:32

`inspect.currentframe` — call-stack frame introspection (ast pass, confidence 0.70)
```
current_file = inspect.getfile(inspect.currentframe())
current_dir = Path(os.path.dirname(os.path.abspath(current_file)))
```
likely benign LLM, confidence 0.93 Uses inspect.currentframe to find the tutorial file's directory.
Reasoning
The tutorial uses the current frame's file to find its own directory so it can locate an extern library. Frame introspection is ordinary in a tutorial.
info ~~warn~~ → info by review dynamic-import third_party/amd/backend/driver.c:362:20

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
  for (int i = 0; i < n; ++i) {
    void *handle = dlopen(hipLibSearchPaths[i], RTLD_LAZY | RTLD_LOCAL);
    if (handle) {
      lib = handle;
```
likely benign LLM, confidence 0.90 Dynamic dlopen of the HIP library across configured search paths.
Reasoning
Loads HIP runtime from a list of search paths, a standard GPU driver loader pattern in Triton; non-literal path is expected.
info ~~critical~~ → info by review dynamic-execution third_party/amd/python/examples/gluon/moe_utils/specialize.py:36:5

`exec` called on a constructed string (ast pass, confidence 0.80)
```
    exec_globals.update({"stored_functions": stored_functions})
    exec(src + "\n\nstored_functions.append(" + function_name + ")\n", exec_globals)

    f.__signature__ = inspect.signature(stored_functions[0])
```
likely benign LLM, confidence 0.85 Example code execs generated source to specialize a kernel function.
Reasoning
exec on source string built from function source for specialization in an example; not a supply-chain attack pattern, though exec of constructed code is risky. The source comes from the program's own kernel code, not external input, so it appears to be a legitimate codegen technique.

info ~~warn~~ → info by review dynamic-attribute third_party/nvidia/backend/driver.c:401:49

`dlsym` called with a non-literal symbol name (ast pass, confidence 0.75)

    dlerror();                                                                 \
    symbolName##_t funcHandle = (symbolName##_t)dlsym(libHandle, #symbolName); \
    /* Check for errors */                                                     \

likely benign LLM, confidence 0.85 Macro resolving CUDA driver functions via dlsym.

Reasoning

Macro wrapping dlsym to resolve CUDA driver symbols by name, a standard loader technique.

info ~~warn~~ → info by review dynamic-import third_party/nvidia/include/cublas_instance.h:70:21

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
      // First reuse the existing handle
      dylibHandle = dlopen(name, RTLD_NOLOAD);
    }
    if (dylibHandle == nullptr) {
```
likely benign LLM, confidence 0.85 Loads cuBLAS shared library dynamically.
Reasoning
Reuses or loads the cuBLAS library by name with RTLD_NOLOAD fallback; standard runtime loader.
info ~~warn~~ → info by review dynamic-import third_party/nvidia/include/cublas_instance.h:74:21

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
      // If not found, try to load it
      dylibHandle = dlopen(name, RTLD_LOCAL | RTLD_LAZY);
    }
    if (dylibHandle == nullptr) {
```
likely benign LLM, confidence 0.85 Fallback dlopen of cuBLAS shared library.
Reasoning
Fallback dlopen of cuBLAS by name; standard pattern.
info ~~warn~~ → info by review dynamic-attribute third_party/nvidia/triton_nvidia.cc:51:20

`dlsym` called with a non-literal symbol name (ast pass, confidence 0.75)
```
    dlerror();
    auto *symbol = dlsym(dylibHandle, name);
    if (const char *error = dlerror()) {
      throw std::runtime_error(
```
likely benign LLM, confidence 0.85 Helper resolving a named symbol from a loaded library.
Reasoning
Generic dlsym helper wrapper with error checking, typical of library loading code.
info ~~warn~~ → info by review dynamic-import third_party/proton/csrc/include/Driver/Dispatch.h:110:16

`dlopen` called with a non-literal path (ast pass, confidence 0.75)
```
        auto fullPath = dir + "/" + libraryName;
        *lib = dlopen(fullPath.c_str(), RTLD_LOCAL | RTLD_LAZY);
      } else {
        // Only if the default path is not set, we try to load it from the
```
likely benign LLM, confidence 0.85 Loads a driver library from a configured path in the Proton dispatch layer.
Reasoning
Loads profiler driver libraries from a configured directory or default name; expected for a GPU profiler dispatch layer.
info ~~warn~~ → info by review dynamic-attribute third_party/proton/csrc/include/Driver/Dispatch.h:139:39

`dlsym` called with a non-literal symbol name (ast pass, confidence 0.75)
```
    if (handler == nullptr) {
      handler = reinterpret_cast<FnT>(dlsym(ExternLib::lib, functionName));
      if (handler == nullptr) {
        throw makeRuntimeError("Failed to load " +
```
likely benign LLM, confidence 0.85 Resolves a driver function pointer via dlsym.
Reasoning
Resolves function pointers by name from the driver library, a standard dispatch technique.
info ~~warn~~ → info by review dynamic-attribute third_party/proton/csrc/include/Driver/Dispatch.h:161:19

`dlsym` called with a non-literal symbol name (ast pass, confidence 0.75)
```
    if (ExternLib::lib != nullptr) {
      void *sym = dlsym(ExternLib::lib,
                        ExternLib::symbolName); // pick any known symbol
      Dl_info info;
```
likely benign LLM, confidence 0.85 Looks up a known symbol to locate the loaded library.
Reasoning
Picks a known symbol to identify a loaded library path via dladdr-style info; benign library introspection.

info dynamic-execution third_party/proton/scripts/dump_ttgir.sh:13:1

command name is a variable (`$cmd`) that this file sets only to plain text (ast pass, confidence 0.40)


TRITON_ALWAYS_COMPILE=1 TRITON_KERNEL_DUMP=1 TRITON_DUMP_DIR=$DUMP_DIR $cmd
# Iterate over all subdirectories in $DUMP_DIR and remove all except the .ttgir files
for dir in "$DUMP_DIR"/*; do

info ~~warn~~ → info by review identifier-confusable-collision unittest/Tools/LinearLayoutTest.cpp:226:16

two identifiers collapse to visual skeleton `||` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)
```
TEST_F(LinearLayoutTest, Compose) {
  LinearLayout l1(
      {
          {S("in1"), {{1, 1}, {0, 1}}},
```
likely benign LLM, confidence 0.90 Test labels such as in1 and in2 in a LinearLayout compose test are flagged as visually confusable.
Reasoning
The collision is between identifiers like in1 and similar names in a unit test for LinearLayout composition. Visual confusability of short test labels in a test file is a common false positive from the token pass and has no malicious function.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
git clone https://github.com/triton-lang/triton triton && cd triton
git checkout v3.9.0
disclude scan --untrusted --severity info --diff v3.8.0 .