# Duplicate check - ONNX SplitToSequence scalar split=0 SIGFPE

Date: 2026-06-23

## Candidate

Title: `SplitToSequence scalar split=0 crashes ONNX shape inference via integer modulo by zero`

Repo: `onnx/onnx`

Targets:

- `Huntr:model-onnx`
- `Huntr:github-onnx-onnx`

## Huntr repo page

Checked `https://huntr.com/repos/onnx/onnx` with the local Huntr dedup checker in Playwright mode.

Result:

- Total reports observed: 55
- Checker risk: `DUPE`
- Reason for tool risk: broad class overlap with ONNX denial-of-service reports, especially the existing `Integer divide-by-zero in ONNX Conv/Pool shape inference...` report.

Manual assessment:

- No visible report title contains `SplitToSequence`.
- No visible report title contains `split=0`, scalar `split`, or sequence split shape inference.
- Closest class match is the existing Conv/Pool shape-inference divide-by-zero report. This is not an exact duplicate because this candidate uses `SplitToSequence`, a scalar `split` initializer, and root cause in `onnx/defs/sequence/utils.cc`.
- Existing user-submitted ONNX reports in `hacnho-huntr/my-reports-submitted.md` are recursion/function-cycle findings and do not overlap this scalar modulo-by-zero path.

Saved raw checker outputs:

- `duplicate-check.json`
- `duplicate-check-playwright.json`

## GitHub issue search

Command:

```bash
gh issue list -R onnx/onnx --state all --search 'SplitToSequence zero split SIGFPE "Floating point exception" "modulo by zero"' --limit 20 --json number,title,state,url,createdAt,updatedAt
```

Result: `[]`

Command:

```bash
gh issue list -R onnx/onnx --state all --search 'SplitToSequence zero split' --limit 20 --json number,title,state,url,createdAt,updatedAt
```

Relevant results:

- `#6356` - `Why does SplitToSequence not allow zeros in split input?` - open - `https://github.com/onnx/onnx/issues/6356`
- `#4742` - `Split-18 performs differently compared to np.array_split, torch.tensor_split for last element in uneven split` - open - `https://github.com/onnx/onnx/issues/4742`

Assessment:

- `#6356` is a spec/question issue about whether zero split values should be allowed. It does not report a crash, SIGFPE, security impact, or the scalar modulo-by-zero path.
- `#4742` is about Split behavior parity, not `SplitToSequence` SIGFPE.

Command:

```bash
gh issue list -R onnx/onnx --state all --search 'SplitToSequence shape inference' --limit 20 --json number,title,state,url,createdAt,updatedAt
```

Relevant results:

- `#6656` - `Shape inference error after SplitToSequence` - open - `https://github.com/onnx/onnx/issues/6656`
- `#2693` - `Shape inference error in test_sequence_model8` - closed - `https://github.com/onnx/onnx/issues/2693`

Assessment:

- `#6656` is a wrong shape inference result involving `keepdim=0`, not a process crash or divide-by-zero.
- `#2693` is an old sequence model shape inference error, not this crash path.

Command:

```bash
gh issue list -R onnx/onnx --state all --search 'SIGFPE OR "Floating point exception" OR divide-by-zero OR "divide by zero"' --limit 20 --json number,title,state,url,createdAt,updatedAt
```

Assessment:

- Results did not include a `SplitToSequence` scalar split crash.

## Web search

Queries checked:

- `site:huntr.com/bounties onnx SplitToSequence zero split`
- `site:huntr.com/bounties onnx SplitToSequence SIGFPE`
- `site:huntr.com/bounties onnx "Floating point exception" "SplitToSequence"`
- `site:huntr.com/bounties onnx "modulo by zero" "SplitToSequence"`

Assessment:

- No public exact duplicate was found for `SplitToSequence` scalar `split=0` SIGFPE.

## Verdict

Not an exact duplicate based on public Huntr/GitHub checks.

Duplicate risk is still medium-high because ONNX has a crowded Huntr page and one pending Conv/Pool divide-by-zero shape-inference report. Submit only with precise root-cause distinction:

- Operator: `SplitToSequence`
- Input: scalar `split` initializer with value `0`
- Source: `onnx/defs/sequence/utils.cc`
- Crash: native `SIGFPE` at `splitDimValue % splitSizes[0]`