redis-0004 + dragonfly-0001: ACL channel O(C×P) + cluster migration O(M²); memcached CLEAN; count 599→601

defects/memcached/patch/memcached-CLEAN.md

@@ -0,0 +1,15 @@
+# Memcached CWE-407 Scan — CLEAN
+
+**Scan date:** 2026-03-28
+
+## Findings
+
+- `assoc.c:70` `assoc_find()` — hash bucket walk O(chain length). Hash pre-computed
+  by caller, averages O(1). Not called in nested loops.
+- `items.c` eviction loop — LRU tail walk bounded at `tries=5`. Not quadratic.
+- `crawler.c` — LRU crawler calls `assoc_find()` once per item with pre-computed hash.
+- `thread.c` — connection queue uses `STAILQ` push/pop, no membership scan.
+
+## Conclusion
+
+Memcached uses pre-hashed keys throughout. No CWE-407 defects found.