infra-cluster: consul/helm/doris CWE-407 scan; buildkit/containerd/traefik/grafana/victoria-metrics/nifi/samza CLEAN

consul-0001: makeMeshGatewayPeerFilterChain peerNames O(S×B×P) slice scan → map[string]struct{}
helm-0001: ResourceList.Difference/Intersect O(N²) via Contains → pre-built map index
doris-0001: EquivalenceClass.getEquivalenceSetList ArrayList visited O(V²) → IdentityHashMap
doris-0002: PlanNode.addConjunct ArrayList.contains O(C²) → LinkedHashSet

6 CLEAN: buildkit, containerd, traefik, grafana, victoria-metrics, nifi (except pre-existing 0001), samza

defects/containerd/patch/CLEAN.md

@@ -1,17 +1,16 @@
 # containerd — CWE-407 Scan Result: CLEAN
 
-Scanned: 2026-03-29
+Scanned 2026-03-29.
 
-## Scope
+## Findings
 
-- `cache/refs.go` — `walkUniqueAncestors`/`walkBlobVariantsOnly`: uses
-  `map[digest.Digest]struct{}` visited set for layer graph traversal. Correct O(V+E).
-- `cache/remotecache/v1/` — `addItemToStorage`, `getRemoteChain`: both use
-  `map[*item]*itemWithOutgoingLinks` / `map[int]struct{}` visited guards. Correct.
-- All `slices.Contains` call sites: used on small bounded option/capability slices
-  (mount options, platform lists), never inside a per-item outer loop.
+`slices.Contains` is used in several paths (mount options, capabilities, snapshotter
+capabilities, platform lists) but all target lists are small and bounded (typically
+< 10 elements): mount option flags, GID lists, network namespace types.
 
-## Verdict
+No O(N²) patterns in hot paths (content ingestion, snapshot chain management,
+layer unpacking). The `cacheResultStorage.HasLink()` in `remotecache/v1/cachestorage.go`
+calls `slices.Contains(it.links[l], target)` but `it.links[l]` is a deduplicated
+list of cache targets per link key — bounded in practice.
 
-No CWE-407 defects found. containerd's layer deduplication and cache traversal use
-proper hash-map visited guards.
+**Verdict: CLEAN** — no CWE-407 defects warranting a patch.