The vulnerability stems from Libsvm's svm_predict_values in svm.cpp, which crashes when _n_support contains invalid values. However, scikit-learn's SVC/SVR predict method (via _validate_for_predict) was responsible for validating model integrity before invoking Libsvm. The absence of checks for _n_support consistency in scikit-learn's pre-patch code allowed crafted models to reach Libsvm's vulnerable function. The fix added validation in _validate_for_predict, confirming these as the critical points.