Unauthenticated arbitrary memory write via RPC tensor pointer

Write-what-where in llama.cpp before b3561 allows remote attackers to overwrite arbitrary process memory through the RPC server. rpc_server::set_tensor trusts the serialized rpc_tensor.data pointer and passes it to ggml_backend_cpu_buffer_set_tensor, where memcpy writes supplied bytes without checking that the destination lies inside the allocated backend buffer. RPC network reachability is the only gate; unauthenticated requests enable process crashes and an arbitrary-write primitive that supports code execution when paired with an address-read primitive.