# UNDF: UNDF-2026-000000468
# neovim — CLEAN

## Scan Date

2026-03-27

## Files Scanned

- `src/nvim/runtime.c` (runtimepath loading, package autoload)

## Findings

No CWE-407 defects found.

### `ga_loaded` in `script_autoload()`

The `ga_loaded` garray is scanned linearly O(P) to check if a package was
already loaded. However, `script_autoload()` is called once per function
resolution, not inside an inner loop. The call site does not create a
cross-product. This is O(P) per-call, not O(N×P).

### Verdict

CLEAN — no algorithmic complexity defects in scanned code paths.
