whitepaper: re-add 10 missing entries + 11 new defects this session, count 578→590; rebuild PDF

defects/lighttpd/patch/lighttpd-CLEAN.md

@@ -0,0 +1,24 @@
+# lighttpd — CWE-407 scan result: CLEAN
+
+## Scan date: 2026-03-27
+
+## Files scanned
+
+| File | Finding |
+|------|---------|
+| `src/connections.c` | CLEAN — chunk-type scan in `connection_write_chunkqueue` is a single-pass linear traversal, not a nested membership test |
+| `src/plugin.c` | CLEAN (startup-only) — `plugins_load` nested loop is O(M×F) at startup only, where F is a compile-time fixed-size static table; not per-request |
+
+## Notes
+
+`plugins_load` contains an outer loop over configured modules and an inner
+`strcmp` scan over a static `load_functions[]` array.  This is startup-only
+(runs once at server init) and F is bounded by the number of compiled-in
+modules (fixed at build time, typically < 100).  This does not meet the CWE-407
+threshold for a ticketed defect.
+
+`connection_write_chunkqueue` scans from `cq->first` forward to find the
+first non-MEM_CHUNK element for TCP_CORK optimisation.  This is a single
+linear pass per write call, not a nested O(N²) membership test.
+
+**Verdict: CLEAN**