If the nvidia driver has a bug, can one workload access data of another running on the physical machine?

E.g. it came up in this thread: https://news.ycombinator.com/item?id=41672168

Yes. The kernel has access to data from every workload, and so technically a bug in _anything_ running at kernel level could result in data leakage.

Suppose I ask for two H100s. Will I have GPU P2P capabilities?

Yep! This is something we have internal tests for haha, you have good instincts that it can be tricky. Here's an example of using that for multi-GPU training https://modal.com/docs/examples/llm-finetuning

Okay, well think very deeply about what you are saying about isolation; the topology of the hardware; and why NVIDIA does not allow P2P access even in vGPU settings except in specific circumstances that are not yours. I think if it were as easy to make the isolation promises you are making, NVIDIA would already do it. Malformed NVLink messages make GPUs fall off the bus even in trusted applications.

Yes it will.

(I work at Modal.)