# MAME — 5-MOAD Scan Result: CLEAN

**Date:** 2026-03-31
**Scanner:** agent blackops
**Scope:** src/emu/, src/frontend/mame/, src/devices/ (targeted grep)

## MOAD-0001 (CWE-407): CLEAN

Searched for `std::find(` on vector/array containers inside loops, dedup patterns
with `push_back`, visited-list membership, and linear container scans in hot paths.

All `std::find` usages fall into safe categories:

1. **Constant-bounded containers:** Input type arrays (ioport.cpp), page mappings,
   parent chains (1-3 deep)
2. **Cycle detection on tiny chains:** Layout group nesting (rendlay.cpp),
   software parent chains (romload.cpp) -- depth < 5
3. **Cold paths only:** Validation code, info XML generation, CLI options
4. **Character/string searches:** Not container membership tests
5. **Driver lookup:** Uses a sorted `s_drivers_sorted[]` with binary search in
   drivenum.cpp -- O(log N), no defect

## MOAD-0002 (Intertangle): CLEAN

MAME uses a `running_machine` object that owns all subsystems. Device state is
encapsulated per-device. No shared mutable god-object coupling unrelated subsystems.
`g_profiler` is a profiling-only singleton with no behavioral coupling.

## MOAD-0003 (Leaked Context): CLEAN

No `thread_local` or `__thread` declarations found in src/emu/ or src/frontend/.
MAME is architecturally single-threaded (one machine per process).

## MOAD-0004 (CWE-312 Logged Secret): CLEAN

No credential, token, password, or API key logging found. `osd_printf_*` calls
log game state and configuration only.

## MOAD-0005 (Thundering Herd): CLEAN

Our only significant cache is `driver_enumerator::m_config` (machine_config LRU).
MAME is single-threaded; no concurrent cache population races are possible.
