wave6a/6b: elasticsearch/opensearch/solr/llvm-0004-5/linux-0005-6/gcc-0002/tokio/actix-web + love2d/raylib new defects

defects/zig/patch/zig-scan-notes.md

@@ -0,0 +1,34 @@
+# Zig CWE-407 Scan — CLEAN
+
+## Date
+2026-03-27
+
+## Scope
+- `src/Sema.zig` — semantic analysis, type inference, comptime evaluation
+- `src/InternPool.zig` — type/value interning
+- `src/Zcu.zig`, `src/Zcu/PerThread.zig` — compilation unit management
+- `src/Air/Liveness.zig` — liveness analysis
+- `src/link/Elf.zig`, `src/link/Elf/` — ELF linker
+- `src/link/MachO.zig`, `src/link/Elf/synthetic_sections.zig`
+- `src/codegen/x86_64/CodeGen.zig`, `src/codegen/llvm.zig`
+
+## Findings
+No CWE-407 defects found. Zig's compiler is well-designed with O(1) data structures
+throughout all hot paths:
+
+- **Error set membership**: `InternPool.ErrorSetType.nameIndex` uses a hash map (`names_map`)
+  — O(1) lookup.
+- **Error set merge**: `errorSetMerge` builds via `InferredErrorSet.NameMap` (hash map) — O(N).
+- **Liveness analysis**: `live_set` is `AutoHashMapUnmanaged` — O(1) operations.
+- **Switch dedup**: `seen_errors` is `AutoHashMap` — O(1) operations.
+- **GOT/PLT entries**: Indexed via `symbol.flags.has_got` / `symbol.addExtra` — O(1).
+- **Rpath dedup**: `rpath_table` is a hash map — O(1).
+- **Analysis tracking**: `outdated`, `failed_analysis`, `analysis_in_progress` are all
+  `AutoHashMapUnmanaged` or `AutoArrayHashMap` — O(1) contains checks.
+
+The one instance of `std.mem.indexOfScalar` found (`src/InternPool.zig:1890`) is a
+null-check for underscore characters in strings — not a membership test in a hot loop.
+
+## Conclusion
+Zig CLEAN for CWE-407. The language team has consistently chosen hash-based data
+structures for all compiler-internal membership tracking.