emulator scan: MAME/Dolphin/ScummVM all CLEAN — no CWE-407 defects

Scanned three major emulator codebases for algorithmic complexity defects:
- MAME: proper maps/enumerators, std::find only on constant-bounded arrays
- Dolphin: exceptionally clean, HashMap/unordered_map throughout hot paths
- ScummVM: Common::find on tiny collections only, HashMap for config lookups

defects/dolphin/scan/CLEAN.md

@@ -0,0 +1,28 @@
+# Dolphin Emulator — CWE-407 Scan Result: CLEAN
+
+**Date:** 2026-03-30
+**Scanner:** agent blackops
+**Scope:** Source/Core/ (full clone)
+
+## Methodology
+
+Searched for `std::find(`, `std::ranges::find(`, `Common::Contains()` on
+vector/array containers inside loops. Examined all 18 files with Contains-in-loop
+patterns. Checked shader cache, netplay, input mapping, game list, and config
+subsystems.
+
+## Findings
+
+Dolphin is exceptionally clean:
+
+1. **Map-based lookups throughout:** Shader cache (ProgramShaderCache), texture
+   cache (HiresTextures), partition lookups (VolumeWii), state caches — all use
+   `std::map`/`std::unordered_map` with O(log N) or O(1) lookups
+2. **Common::Contains wrapper:** Uses `std::ranges::contains` under the hood —
+   all usages found are on constant-bounded collections (BitSet32 textures,
+   PPC registers, Vulkan extensions at init, present modes)
+3. **No hot-path linear scans:** All vector membership checks occur in
+   initialization, user-triggered actions, or debugger code
+4. **Resource pack dedup:** O(T*P*Tp) but packs are few and user-triggered install
+
+No CWE-407 defects found.

defects/mame/scan/CLEAN.md

@@ -0,0 +1,25 @@
+# MAME — CWE-407 Scan Result: CLEAN
+
+**Date:** 2026-03-30
+**Scanner:** agent blackops
+**Scope:** src/emu, src/frontend, src/lib/util (sparse checkout)
+
+## Methodology
+
+Searched for `std::find(` on vector/array containers inside loops, dedup patterns
+with `push_back`, visited-list membership, and linear container scans in hot paths.
+
+## Findings
+
+All `std::find` usages in MAME fall into safe categories:
+
+1. **Constant-bounded containers:** Input type arrays (ioport.cpp), page mappings
+   (SCREEN_PAGE_NUM=16), parent chains (1-3 deep)
+2. **Cycle detection on tiny chains:** Layout group nesting (rendlay.cpp),
+   software parent chains (romload.cpp) — depth < 5
+3. **Cold paths only:** Validation code (validity.cpp), info XML generation
+   (infoxml.cpp), CLI options (submenu.cpp)
+4. **Character/string searches:** Not container membership tests
+
+MAME uses proper data structures (maps, sets, enumerators) for hot-path lookups.
+No CWE-407 defects found.

defects/scummvm/scan/CLEAN.md

@@ -0,0 +1,28 @@
+# ScummVM — CWE-407 Scan Result: CLEAN
+
+**Date:** 2026-03-30
+**Scanner:** agent blackops
+**Scope:** common/, engines/, backends/, base/ (sparse checkout, ~17k source files)
+
+## Methodology
+
+Searched for `Common::find(` on Array containers inside loops, dedup patterns,
+visited-list membership in graph traversals. Examined all 47 occurrences across
+30 engine files plus common library and base code.
+
+## Findings
+
+ScummVM's Common::find usages are all safe:
+
+1. **Constant-bounded containers:** Sound channels (<16), screen pages (16),
+   active actions (<10 simultaneous keys), playing chores (<20), save slots (<10)
+2. **Dedup on tiny collections:** restoredSounds (loop of 8), realPages (16),
+   costume materials (<50), animation scales (<10)
+3. **Graph traversal visited lists (tools only):** Stark decompiler block
+   predecessor/successor checks — development tool, not runtime
+4. **Config/CLI lookups:** Engine name matching in command line processing,
+   minigame config parameters — initialization-only code
+5. **HashMap for hot lookups:** ConfigManager uses HashMap throughout,
+   Archive uses fileMap/directoryMap
+
+No CWE-407 defects found.