fix: L2 op#24 KvCacheUpdateWithRopeBackward cache_position OOB

[zhshgmail]

Problem

L2 op#24 24_KvCacheUpdateWithRopeBackward has an unusable benchmark — all 50 cases are schema-invalid. The .json omits a range field for cache_position (int64), and model.py's int branch hardcodes max_val=10000 in torch.randint. But cache_position must satisfy cache_position.max() < grad_key_cache.shape[2] (= max_seq, range 16..2048). So all 50 cases produce OOB indices by ~5-500x.

Symptom: reference Model.forward() on NPU executes grad_key_cache[:, :, cache_position] fancy indexing → hardware fault error 507035 / AIV 334 subErrType 0x4 ("BIU data to VEC incorrect") at deterministic PC across all 56 cores. Once faulted, the NPU stream is sticky-poisoned and subsequent torch.npu.synchronize() calls all return 507035 regardless of input validity. Effect on pass rate: ref 1/50 PASS + 49/50 CRASH (the one pass is case 0 where cp.max() accidentally falls in bound).

This is the same class as PR #84 (L1 op#24 EmbeddingDenseBackward) from @zhshgmail 2026-04-13 but affecting L2.

Fix

1. 24_KvCacheUpdateWithRopeBackward.json: add "range": [0, max_seq - 1] to each cache_position input across all 50 cases. max_seq is grad_key_cache.shape[2].

2. 24_KvCacheUpdateWithRopeBackward.py: the int branch of get_input_groups() now reads inp.get('range', [0, default_max - 1]) and uses torch.randint(rng[0], rng[1] + 1, shape) with the range inclusive on both ends. Default fallback [0, default_max - 1] exactly matches the original torch.randint(0, default_max) behavior, so cases without a range field are untouched.

Scope & backward compatibility

• Only 24_KvCacheUpdateWithRopeBackward.py is modified. Its get_input_groups() is custom (not shared). Other L2 ops using the generic template (22 files) are untouched.
• The default_max - 1 fallback in my .py change guarantees byte-identical output for any case without a range field. Verified by local CPU run.
• Approach mirrors PR 修复 24_EmbeddingDenseBackward 索引越界问题 #84 exactly: .json adds range + .py reads range with sensible default. L1 op#24 .py already had this pattern (line 54); L2 op#24 needed its own edit since the two files don't share code.

Verification

CPU: parsed all 50 cases post-fix → cache_position values all in [0, max_seq-1], OOB count 0/50 (was 50/50).

NPU (A5 Ascend950PR_9589, CANN 9.0.0):

• Before fix: reference Model.forward() 1/50 PASS + 49/50 CRASH (507035).
• After fix: reference Model.forward() 50/50 PASS + 0 CRASH, no NPU stream poisoning. Kernel verification (ModelNew) can now proceed normally.

Refs

• Mirrors PR 修复 24_EmbeddingDenseBackward 索引越界问题 #84 (L1 op#24 EmbeddingDenseBackward OOB fix).
• Related: PR [bugfix] Moe benchmark 修复 #107 / Br 430 #108 (MoE benchmark reference implementation fixes by @xulei292) which addressed similar "schema-invalid inputs break reference" patterns in L2 op#4/5/6/7.