whitepaper: re-add 10 missing entries + 11 new defects this session, count 578→590; rebuild PDF

defects/caddy/patch/caddy-0001.patch

@@ -1,3 +1,4 @@
+# UNDF: UNDF-2026-000000020
 --- a/modules/caddyhttp/reverseproxy/selectionpolicies.go
 +++ b/modules/caddyhttp/reverseproxy/selectionpolicies.go
 @@ -1,6 +1,7 @@

defects/caddy/patch/caddy-matchers-upstreams-CLEAN.md

@@ -0,0 +1,24 @@
+# Caddy matchers.go + upstreams.go — CWE-407 scan result: CLEAN
+
+## Scan date: 2026-03-27
+
+## Files scanned
+
+| File | Finding |
+|------|---------|
+| `modules/caddyhttp/matchers.go` | CLEAN — see notes |
+| `modules/caddyhttp/reverseproxy/upstreams.go` | CLEAN |
+
+## Notes
+
+**matchers.go `matchHeaders`**: Contains a triple-nested loop O(H×A×V) where
+H = header fields in matcher config, A = actual header values per field,
+V = allowed values per field.  All three dimensions are practically bounded
+to small constants by HTTP header semantics (H ≤ 10, A ≤ 5, V ≤ 5).
+This does not produce unbounded O(N²) growth and does not meet the CWE-407
+threshold.
+
+**upstreams.go**: SRV/A record loops use map-based O(1) lookups
+(`srvs[suAddr]`, `aAaaa[auStr]`).  No nested linear membership tests found.
+
+**Verdict: CLEAN** (beyond caddy-0001 which is already patched)