"read_tensor" builds a tensor "shape" from attacker-controlled 32-bit dimensions and computes the element count "len = product(shape)" and the byte allocation "product(shape) * size_of(dt)" with unchecked "usize" arithmetic. In "--release" (no "overflow-checks"), both products wrap modulo 2^64. An attacker chooses dimensions so that the wrapped products collapse to a small value that satisfies the header consistency check, while the true element count remains astronomically large. "read_tensor" returns "Ok" with a "Tensor" whose reported "len" (e.g. 2^61+7) is far larger than its backing heap allocation (e.g. 56 bytes). The unchecked slice accessor "as_slice_unchecked" ("from_raw_parts(ptr, self.len)") then produces a slice spanning ~18 exabytes over a 56-byte buffer. The out-of-bounds read fires automatically during model build (no inference required), reachable through the default "DatLoader" resource loader.