Describe the issue:

I have generated a report of issues found by cext-review-toolkit in the NumPy codebase. Here's the summary:

The most critical findings are: 3 use-after-free bugs in the ufunc dispatch path (dispatching.cpp), 2 user-triggerable crashes from non-ASCII input, 2 heap corruption bugs in timsort, and an unfixed empty-vector bug in OBJECT_dot identical to a recently fixed bug in OBJECT_dotc.

The full report is at https://gist.github.com/devdanzin/ccc2d9553ca1c90ab1835362ee21a40a#file-numpy_report-md

Reproduce the code example:

The reproducers for 5 crashes are at https://gist.github.com/devdanzin/ccc2d9553ca1c90ab1835362ee21a40a#file-numpy_report_appendix-md

Error message:

Python and NumPy Versions:

All tested with NumPy 2.4.3 on Python 3.14.

Runtime Environment:

[{'numpy_version': '2.4.3',
'python': '3.14.3+ (heads/3.14:6080c866096, Mar 16 2026, 00:17:17) [Clang '
'21.1.2 (2ubuntu6)]',
'uname': uname_result(system='Linux', node='gmknees', release='6.17.0-19-generic', version='#19-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar 6 14:02:58 UTC 2026', machine='x86_64')},
{'simd_extensions': {'baseline': ['X86_V2'],
'found': ['X86_V3', 'X86_V4', 'AVX512_ICL'],
'not_found': ['AVX512_SPR']}},
{'ignore_floating_point_errors_in_matmul': False},
{'architecture': 'SkylakeX',
'filepath': '/home/danzin/venvs/cext-review-toolkit/lib/python3.14/site-packages/numpy.libs/libscipy_openblas64_-ff84a88b.so',
'internal_api': 'openblas',
'num_threads': 16,
'prefix': 'libscipy_openblas',
'threading_layer': 'pthreads',
'user_api': 'blas',
'version': '0.3.31.dev'}]

How does this issue affect you or how did you find it:

I'm developing cext-review-toolkit and NumPy was one of the C extensions I chose to analyze.