Summary (memory safety only — see "Scope" below)

Several gl.amd.cdna3.buffer_store(ptr=OutLogits_buffer, …) sites in the Gluon
pa_mqa_logits kernels write float32 logits at logical column indices col
without an upper bound on col < max_model_len. Existing predicates only cover
the lower bound (e.g. col >= 0 or col >= split_context_start). When
context_length == max_model_len and split_context_length is rounded up to
the next KVBlockSize, the inner-loop tail can issue stores up to
(KVBlockSize − 1) + (ChunkKPerStage − 1) columns past the end of the
OutLogits_buffer allocation. That is the textbook unmasked-buffer_store
overshoot pattern.

This patch combines (col < max_model_len) with the existing predicate via
& at every OutLogits_buffer store site in:

• _gluon_deepgemm_fp8_paged_mqa_logits
• _gluon_deepgemm_fp8_paged_mqa_logits_preshuffle
• _gluon_deepgemm_fp8_paged_mqa_logits_preshuffle_varctx

So lanes with col >= max_model_len are predicated off and no longer issue a
buffer_store. Nothing else in the kernel body (KV/scale loads, MFMA,
gl.reduce, the tl.where that fills o) is touched, so for any in-bounds
column the value of OutLogits_buffer[batch, col] is bit-identical before and
after this PR.

Scope (read this first)

• This PR is a memory-safety / OOB-write fix only. It removes
  undefined-behaviour writes that can produce HIP "Memory access fault by GPU"
  (MAF) failures or silently corrupt neighbouring memory.
• This PR does not claim to change numerical answers for in-bounds
  columns. By construction it cannot — the upstream computation path is
  untouched.
• Therefore, this PR also does not address the documented long-context
  numerical regression in _gluon_deepgemm_fp8_paged_mqa_logits_preshuffle
  on gfx950 (top-k mismatch vs. deepgemm_fp8_paged_mqa_logits_stage1 once
  context_len exceeds ~2048; see vLLM
  #39303). That accuracy
  bug is a separate kernel-integration issue (SplitKV tiling, KV-block
  addressing in the LoadBlockIndiceForEachStage branch, MFMA operand
  orientation) and will be addressed in a follow-up.

Worked bounds example

With max_model_len = 100, ChunkKPerStage = 32, context_idx = 75: lane
columns 75 … 106 were emitted. Only 75 … 99 are valid;
the last 7 lanes were performing OOB stores. With this PR they are
predicated off.

With ChunkK = 256, ChunkKPerStage = 128, max_model_len = 5120,
context_idx = 5040: indices up to 5167 are emitted; 48 tail lanes
past 5119 were performing OOB stores and are now predicated off.

Validation

The vLLM-side variant is the operational equivalent of this PR (it lets the
kernel's overshoot land in safe row padding instead of relying on the kernel
to predicate). Both are valid mitigations for the same memory-safety bug; the
kernel-side fix in this PR removes the dependency on caller-side padding and
is the right layer for the fix.

Patch reproducibility

Regenerate via the supplied diff or cherry-pick from the branch tip; only
buffer_store predicates change.

Checklist

• Ruff / Black clean on touched file
• All listed kernels: (col < max_model_len) &-combined with prior
  predicate on every OutLogits_buffer store
• Confirmed by external (vLLM-side) operational equivalent that the
  OOB write is the cause of the MAF-class crash
• Upstream ROCm CI fully green on the latest commit before promoting
  from draft to ready-for-review