# Ollama — CWE-407 Scan Result: CLEAN

**Date:** 2026-03-30
**Target:** https://github.com/ollama/ollama (Go)
**Scanner:** Agent Blackops CWE-407 sweep
**Focus:** model registry dedup, runner/scheduler membership, layer dedup, kvcache sequences

## Findings

No CWE-407 defects found. All `slices.Contains` calls operate on bounded slices:

- **kvcache/causal.go**: `slices.Contains(cell.sequences, seq)` — sequences per cell is 1-4 (parallel inference slots), effectively O(1)
- **server/images.go**: Capabilities checks on slices of 3-7 items (model capabilities enum)
- **server/sched.go**: Capability/family string checks against small constant lists
- **ml/backend/ggml/ggml.go**: Device/buffer type checks bounded by hardware count (1-8 GPUs)
- **server/images.go PullModel/PruneLayers**: Uses `map[string]struct{}` for layer dedup — correct O(1) lookup
- **convert/**: Tensor name matching on split strings — bounded by name segments

The codebase uses maps for all data-proportional dedup (blob digests, layer tracking) and reserves `slices.Contains` for small enum-like checks. Well-engineered.
