diff --git a/defects/hurd/patch/0001-CWE-407-hurd-0001-hurd-0006-fix-O-N-M-k-auth-verify-.patch b/defects/hurd/patch/0001-CWE-407-hurd-0001-hurd-0006-fix-O-N-M-k-auth-verify-.patch
index 125966e56..248ffc7f1 100644
--- a/defects/hurd/patch/0001-CWE-407-hurd-0001-hurd-0006-fix-O-N-M-k-auth-verify-.patch
+++ b/defects/hurd/patch/0001-CWE-407-hurd-0001-hurd-0006-fix-O-N-M-k-auth-verify-.patch
@@ -1,9 +1,9 @@
-From a56d5fc886eaea781d1033bf5dc1cd94e4dad4a0 Mon Sep 17 00:00:00 2001
+From c05586601073629e48ed886fbdaa12b9c4c80313 Mon Sep 17 00:00:00 2001
 From: "russell@unturf.com" <russell@unturf.com>
-Date: Sat, 4 Apr 2026 20:29:09 -0400
-Subject: [PATCH 1/2] =?UTF-8?q?CWE-407=20(hurd-0001,=20hurd-0006):=20fix?=
- =?UTF-8?q?=20O(N=C3=97M=C3=97k)=20auth=20verify=20and=20O(k=C2=B2)=20idve?=
- =?UTF-8?q?c=20merge?=
+Date: Sat, 4 Apr 2026 20:31:12 -0400
+Subject: [PATCH] =?UTF-8?q?CWE-407=20(hurd-0001,=20hurd-0006):=20fix=20O(N?=
+ =?UTF-8?q?=C3=97M=C3=97k)=20auth=20verify=20and=20O(k=C2=B2)=20idvec=20me?=
+ =?UTF-8?q?rge?=
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -19,23 +19,23 @@ id by linear scan — O(num × num_old). Fixed by sorting a copy of the existing
 ids and using binary search — O(num_old×log(num_old) + num×log(num_old)).
 Called by S_auth_makeauth on every exec/setuid.
 ---
- auth/auth.c               | 98 ++++++++++++++++-----------------------
+ auth/auth.c               | 97 ++++++++++++++++-----------------------
  libshouldbeinlibc/idvec.c | 51 ++++++++++++++++----
- 2 files changed, 84 insertions(+), 65 deletions(-)
+ 2 files changed, 82 insertions(+), 66 deletions(-)
 
 diff --git a/auth/auth.c b/auth/auth.c
-index d5ef5876..bf75bfe0 100644
+index d5ef5876..a5e99e1c 100644
 --- a/auth/auth.c
 +++ b/auth/auth.c
 @@ -126,6 +126,7 @@ S_auth_makeauth (struct authhandle *auth,
    int hasroot = 0;
    error_t err;
    size_t i, j;
-+  struct idvec all_uids, all_gids;
++  struct idvec all_uids = IDVEC_INIT, all_gids = IDVEC_INIT;
  
    if (!auth)
      return EOPNOTSUPP;
-@@ -141,78 +142,50 @@ S_auth_makeauth (struct authhandle *auth,
+@@ -141,78 +142,47 @@ S_auth_makeauth (struct authhandle *auth,
    /* Verify that the union of the handles passed in either contains euid 0
       (root), or contains all the requested ids.  */
  
@@ -46,16 +46,14 @@ index d5ef5876..bf75bfe0 100644
 -  (idvec_contains (&(auth)->egids, gid) \
 -   || idvec_contains (&(auth)->agids, gid))
 -#define isroot(auth)		isuid (0, auth)
+-
+-  for (i = 0; i < nauths; i++)
+-    if (auths[i] && isroot (auths[i]))
 +  /* CWE-407 fix (hurd-0001): build union sets of permitted UIDs and GIDs from
 +     all auth handles once, then verify all requested IDs against the union.
 +     Old complexity: O((neuids+nauids+negids+nagids) * nauths * k) where k is
 +     idvec size — each requested ID scanned every auth handle linearly.
 +     New complexity: O(nauths * k) build + O(N * log k) verify.  */
-+  idvec_init (&all_uids);
-+  idvec_init (&all_gids);
- 
--  for (i = 0; i < nauths; i++)
--    if (auths[i] && isroot (auths[i]))
 +  for (j = 0; j < nauths; j++)
 +    if (auths[j])
        {
@@ -143,7 +141,7 @@ index d5ef5876..bf75bfe0 100644
    err = create_authhandle (&newauth);
  
    /* Create a new handle with the specified ids.  */
-@@ -237,11 +210,22 @@ S_auth_makeauth (struct authhandle *auth,
+@@ -237,11 +207,22 @@ S_auth_makeauth (struct authhandle *auth,
        ports_port_deref (auths[j]);
    return err;
  
diff --git a/defects/hurd/patch/0002-CWE-407-hurd-0002-hurd-0003-replace-_ports_notificat.patch b/defects/hurd/patch/0002-CWE-407-hurd-0002-hurd-0003-replace-_ports_notificat.patch
index 64e071c69..1191e0fff 100644
--- a/defects/hurd/patch/0002-CWE-407-hurd-0002-hurd-0003-replace-_ports_notificat.patch
+++ b/defects/hurd/patch/0002-CWE-407-hurd-0002-hurd-0003-replace-_ports_notificat.patch
@@ -1,8 +1,8 @@
-From de3b12674e0b0b259d449e70fea83f0491f6d937 Mon Sep 17 00:00:00 2001
+From 25aa731e690c799837c21c09db0d047b811e79c3 Mon Sep 17 00:00:00 2001
 From: "russell@unturf.com" <russell@unturf.com>
-Date: Sat, 4 Apr 2026 20:29:19 -0400
-Subject: [PATCH 2/2] CWE-407 (hurd-0002, hurd-0003): replace
- _ports_notifications linked list with hash table
+Date: Sat, 4 Apr 2026 20:31:12 -0400
+Subject: [PATCH] CWE-407 (hurd-0002, hurd-0003): replace _ports_notifications
+ linked list with hash table
 
 ports_interrupt_rpc_on_notification and ports_interrupt_notified_rpcs both
 scanned the global _ports_notifications linked list in O(N) on every RPC