llama.cpp + aria2: 2 CWE-407 defects, MOAD 0002-0005 CLEAN

llamacpp-0001: llama-grammar.cpp advance_stack/accept_token stacks_new
  dedup via std::find on vector<vector<ptr>>, O(S^2) per grammar-constrained
  token. Fix: companion std::set<llama_grammar_stack> for O(S log S). ~16x at S=300.

aria2-0001: DHTPeerAnnounceEntry addPeerAddrEntry peerAddrEntries_ vector
  std::find dedup, O(P^2) as DHT peers accumulate per infohash. Fix:
  unordered_map keyed by ip:port for O(P) amortized. ~15x at P=3000.

Both: MOADs 0002-0005 CLEAN per scan markers.

defects/aria2/patch/aria2-CLEAN.md

@@ -0,0 +1,59 @@
+# aria2 — 5-MOAD scan
+
+## Scan Date
+
+2026-03-31
+
+## Target
+
+- Repo: https://github.com/aria2/aria2
+- Commit: depth=1 HEAD as of 2026-03-31
+- Files scanned: src/ (all .cc and .h files)
+
+## Findings
+
+### MOAD-0001 (CWE-407) — 1 defect found (see aria2-0001)
+
+`src/DHTPeerAnnounceEntry.cc`: `addPeerAddrEntry()` scans `peerAddrEntries_`
+(a `std::vector<PeerAddrEntry>`) with `std::find` to deduplicate peer
+announcements. O(P^2) total cost as P unique peers are added for a single
+infohash. No size cap exists on `peerAddrEntries_`. Severity: MEDIUM.
+Fixed in aria2-0001.
+
+Other potential sites reviewed and found bounded or non-hot:
+- `DefaultPeerStorage::isPeerAlreadyAdded` uses `uniqPeers_` (`std::set`) — already O(log N).
+- `DefaultPieceStorage::usedPieces_` is `std::set` — already O(log N).
+- `DHTBucket::nodes_` max size K=8 (Kademlia K-bucket) — O(1) in practice.
+- `FeedbackURISelector::selectRarer` nested loop bounded by NUM_URI=10 — O(1).
+- `CookieStorage` bounded by MAX_COOKIE_PER_DOMAIN=50 — O(1).
+- `UTMetadataRequestTracker` bounded by torrent piece count — O(1).
+
+### MOAD-0002 (Intertangle) — CLEAN
+
+`DownloadEngine` is the central coordinator but subsystems communicate via
+clean interfaces (EventPoll, RequestGroup, Command pattern). No shared
+mutable global god object coupling unrelated subsystems found.
+
+### MOAD-0003 (Leaked Context) — CLEAN
+
+No `thread_local` or `pthread_key` usage found in `src/`. aria2 is
+event-driven (single-threaded event loop); there is no per-request identity
+in thread-local storage.
+
+### MOAD-0004 (CWE-312) — CLEAN
+
+HTTP Authorization headers are handled via `HttpHeader` (multimap lookup,
+not logged). Tracker announce URLs do not embed user credentials in the
+standard BitTorrent protocol (info_hash and peer_id are not secrets). No
+verbatim logging of Authorization header or authentication tokens found.
+`Netrc.cc` handles credentials in memory only, no logging.
+
+### MOAD-0005 (Thundering Herd) — CLEAN
+
+aria2 uses a single-threaded event loop (no concurrent cache access). DNS
+cache (`DNSCache`) and RPC method cache (`RpcMethodFactory`) are accessed
+from one thread. No concurrent get+null+compute+put pattern found.
+
+## Verdict
+
+1 defect (aria2-0001). MOADs 0002-0005 CLEAN.