llama.cpp was aliasing CUB's input and output buffers, corrupting argsort.

PR #28389 fixes argsort_f32_i32_cuda_cub() passing the same buffer as d_keys_in and d_keys_out, violating CUB's non-overlap contract. CUB's double-buffer ping-pong overwrote its own input mid-pass and emitted float bit patterns as row IDs, producing out-of-bounds get_rows reads and sticky Xid 31 faults. It only fired above ncols > 1024 with real logit distributions, reproduced on Qwen3.8-27B DFlash speculative decoding with a 248,320-column vocabulary crashing within 1 to 3 tokens. llama.cpp The fix allocates a distinct output buffer at six call sites for about 64MB more transient memory per sort.