emulator scan: MAME/Dolphin/ScummVM all CLEAN — no CWE-407 defects

Scanned three major emulator codebases for algorithmic complexity defects:
- MAME: proper maps/enumerators, std::find only on constant-bounded arrays
- Dolphin: exceptionally clean, HashMap/unordered_map throughout hot paths
- ScummVM: Common::find on tiny collections only, HashMap for config lookups

defects/scummvm/scan/CLEAN.md

@@ -0,0 +1,28 @@
+# ScummVM — CWE-407 Scan Result: CLEAN
+
+**Date:** 2026-03-30
+**Scanner:** agent blackops
+**Scope:** common/, engines/, backends/, base/ (sparse checkout, ~17k source files)
+
+## Methodology
+
+Searched for `Common::find(` on Array containers inside loops, dedup patterns,
+visited-list membership in graph traversals. Examined all 47 occurrences across
+30 engine files plus common library and base code.
+
+## Findings
+
+ScummVM's Common::find usages are all safe:
+
+1. **Constant-bounded containers:** Sound channels (<16), screen pages (16),
+   active actions (<10 simultaneous keys), playing chores (<20), save slots (<10)
+2. **Dedup on tiny collections:** restoredSounds (loop of 8), realPages (16),
+   costume materials (<50), animation scales (<10)
+3. **Graph traversal visited lists (tools only):** Stark decompiler block
+   predecessor/successor checks — development tool, not runtime
+4. **Config/CLI lookups:** Engine name matching in command line processing,
+   minigame config parameters — initialization-only code
+5. **HashMap for hot lookups:** ConfigManager uses HashMap throughout,
+   Archive uses fileMap/directoryMap
+
+No CWE-407 defects found.