The root cause was the lack of input validation in LLMEngine's request processing path (_add_processed_request), which allowed empty prompts to reach the scheduler. The scheduler's _get_num_new_tokens method then triggered an assertion on zero tokens, causing a crash. The high-confidence vulnerable function is the unpatched _add_processed_request, while the medium-confidence scheduler function represents the exploitable assertion (CWE-617). The commit added validation in LLMEngine to prevent empty prompts from reaching the assertion.