Memory corruption via truncated tokenizer result size

Heap buffer overflow in ggml-org llama.cpp before b5721 allows local users to corrupt process memory through crafted tokenizer input. The llama_vocab::tokenize adapter casts res.size() from size_t to signed int before comparing it with n_tokens_max; results above INT_MAX become negative, bypass the size guard, and the copy loop writes past the caller's heap buffer. Reaching the overflow requires a tokenized result above INT_MAX and user interaction with crafted text; the published proof uses a Jinja template and a non-BPE model, and code execution has not been demonstrated.