# UNDF: UNDF-2026-000000210
# Perl5 op.c / toke.c deeper scan — CLEAN for CWE-407

## Targets Scanned

### `op.c` — `Perl_core_prototype()` (line 16590)

`Perl_core_prototype()` contains a `while (i < MAXO)` loop that scans up to
MAXO (~200) opcode entries by name comparison to find a prototype. This is
O(MAXO) per call.

Called once per keyword during tokenisation. Since MAXO is a fixed small
constant (~200), the overall cost is O(N × 200) = O(N) for N keywords in a
source file. **Not O(N²). CLEAN.**

### `toke.c` — Keyword lookup

`keyword()` is called by the tokenizer for each identifier token. Inspection
shows it dispatches through a compiled perfect-hash or switch/case mechanism
(via `keywords.h`). No linear scan over keyword list. **CLEAN.**

`seen[256]` character frequency array in the regex-or-subscript heuristic
is a fixed-size byte array, not a list membership check. **CLEAN.**

## Status: CLEAN for op.c and toke.c

No new CWE-407 defects found beyond the existing perl5-0001 (pad.c findlex).
