emulator scan: MAME/Dolphin/ScummVM all CLEAN — no CWE-407 defects

Scanned three major emulator codebases for algorithmic complexity defects:
- MAME: proper maps/enumerators, std::find only on constant-bounded arrays
- Dolphin: exceptionally clean, HashMap/unordered_map throughout hot paths
- ScummVM: Common::find on tiny collections only, HashMap for config lookups

defects/dolphin/scan/CLEAN.md

@@ -0,0 +1,28 @@
+# Dolphin Emulator — CWE-407 Scan Result: CLEAN
+
+**Date:** 2026-03-30
+**Scanner:** agent blackops
+**Scope:** Source/Core/ (full clone)
+
+## Methodology
+
+Searched for `std::find(`, `std::ranges::find(`, `Common::Contains()` on
+vector/array containers inside loops. Examined all 18 files with Contains-in-loop
+patterns. Checked shader cache, netplay, input mapping, game list, and config
+subsystems.
+
+## Findings
+
+Dolphin is exceptionally clean:
+
+1. **Map-based lookups throughout:** Shader cache (ProgramShaderCache), texture
+   cache (HiresTextures), partition lookups (VolumeWii), state caches — all use
+   `std::map`/`std::unordered_map` with O(log N) or O(1) lookups
+2. **Common::Contains wrapper:** Uses `std::ranges::contains` under the hood —
+   all usages found are on constant-bounded collections (BitSet32 textures,
+   PPC registers, Vulkan extensions at init, present modes)
+3. **No hot-path linear scans:** All vector membership checks occur in
+   initialization, user-triggered actions, or debugger code
+4. **Resource pack dedup:** O(T*P*Tp) but packs are few and user-triggered install
+
+No CWE-407 defects found.