netdata CLEAN; telegraf-0001 dedup GetField O(F²) — 1 defect, 1/1 PASS

Netdata: well-engineered with Judy arrays, dictionaries, hash tables
throughout. No CWE-407 defects found.

Telegraf: dedup processor Apply() calls m.GetField(f.Key) O(F) inside
field comparison loop → O(F²). Fix: build field map for O(1) lookup.
125x overhead at F=500.

defects/netdata/patch/CLEAN.md

@@ -0,0 +1,32 @@
+# Netdata — CWE-407 Scan Result: CLEAN
+
+**Date:** 2026-03-30
+**Scanner:** agent blackops
+**Target:** https://github.com/netdata/netdata (depth=1)
+**Language:** C + Go
+
+## Scan Coverage
+
+- `src/health/` — alarm templates, silencers, prototypes
+- `src/streaming/` — stream path, replication, capabilities
+- `src/database/` — rrdlabels, rrdhost, rrdset, rrddim, contexts, query_target, engine
+- `src/libnetdata/` — adaptive_resortable_list, dictionary, facets, string dedup, user-auth
+- `src/web/` — websocket JSONRPC, MCP, API v1
+- `src/exporting/` — Prometheus exporter server list
+- `src/registry/` — person/machine URL tracking
+- `src/collectors/` — ebpf, log2journal
+- `src/go/plugin/` — job manager, SNMP profile loader, multipath, weblog collector
+
+## Findings
+
+No CWE-407 defects found. Netdata's core data structures are well-engineered:
+
+- **Judy arrays** (JudyL, JudyHS) for labels, metrics registry
+- **Dictionary** (hash-table based) for rrdhost, rrdset, rrddim, contexts
+- **SIMPLE_HASHTABLE** for facets value indexing
+- **Bitmask dedup** for HTTP access flags, RRDR options, stream capabilities
+- **Adaptive Resortable List** (self-sorting linked list) for /proc parsing — amortized fast path
+- **STRING dedup** via global hash table for string interning
+
+The few linked-list scans found (registry person URLs, Prometheus server list, health silencer list)
+are per-request lookups, not inside nested loops. No O(N²) membership patterns detected.