llama.cpp + aria2: 2 CWE-407 defects, MOAD 0002-0005 CLEAN

llamacpp-0001: llama-grammar.cpp advance_stack/accept_token stacks_new
  dedup via std::find on vector<vector<ptr>>, O(S^2) per grammar-constrained
  token. Fix: companion std::set<llama_grammar_stack> for O(S log S). ~16x at S=300.

aria2-0001: DHTPeerAnnounceEntry addPeerAddrEntry peerAddrEntries_ vector
  std::find dedup, O(P^2) as DHT peers accumulate per infohash. Fix:
  unordered_map keyed by ip:port for O(P) amortized. ~15x at P=3000.

Both: MOADs 0002-0005 CLEAN per scan markers.

defects/llamacpp/patch/llamacpp-CLEAN.md

@@ -0,0 +1,53 @@
+# llama.cpp — 5-MOAD scan
+
+## Scan Date
+
+2026-03-31
+
+## Target
+
+- Repo: https://github.com/ggerganov/llama.cpp
+- Commit: depth=1 HEAD as of 2026-03-31
+- Files scanned: src/, common/, tools/server/
+
+## Findings
+
+### MOAD-0001 (CWE-407) — 1 defect found (see llamacpp-0001)
+
+`src/llama-grammar.cpp`: `llama_grammar_advance_stack` and
+`llama_grammar_accept_token` deduplicate grammar stacks via `std::find` on
+`vector<vector<ptr>>`. O(S^2) per sampled token when grammar-constrained
+sampling is active. Severity: MEDIUM-HIGH. Fixed in llamacpp-0001.
+
+### MOAD-0002 (Intertangle) — CLEAN
+
+No god-object coupling found in core inference paths. `llama_context`,
+`llama_model`, and `llama_kv_cache` are well-separated structs with clean
+interfaces. Server state in `tools/server/server.cpp` is encapsulated in
+`server_context`. No shared mutable global spanning unrelated subsystems.
+
+### MOAD-0003 (Leaked Context) — CLEAN
+
+No `thread_local` usage in `src/` or `common/`. The `vendor/cpp-httplib`
+library uses `thread_local` for regex caches and RNG — these are
+implementation-local state, not request-scoped identity carriers. No
+per-request identity leaked across thread boundaries.
+
+### MOAD-0004 (CWE-312) — CLEAN
+
+API keys are masked in logs: `tools/server/server-http.cpp` line 131 logs
+only the last few chars of the key (`****XXXX`). SSL key file path is
+logged (not content). No Authorization header or Bearer token logged verbatim
+in any debug path found.
+
+### MOAD-0005 (Thundering Herd) — CLEAN
+
+KV cache slot allocation (`llama-kv-cache.cpp`) is single-threaded per
+context; llama_context is not shared across threads in the inference path.
+Server handles concurrency by serializing requests to a single context or
+using per-slot contexts. No unsynchronized get+null+compute+put cache pattern
+found.
+
+## Verdict
+
+1 defect (llamacpp-0001). MOADs 0002-0005 CLEAN.