no-stone-unturned wave: 8 new defects, 15 CLEAN confirmations; count 621→629

New defects (all PASS):
- exim-0001: same_hosts() MX-segment O(H²) → AVL set O(H log H), 10.5x at H=20
- minecraft-0001: DependencySorter.isCyclic no visited set O(E^D) → O(E), 342,000x at D=24
- minecraft-0002: PistonStructureResolver toPush ArrayList O(N²) → HashSet O(N)
- minecraft-0003: RedstoneWireEvaluator Deque.contains O(N²) → HashSet O(N)
- minecraft-0004: MoveThroughVillageGoal visited List O(N²) → HashSet O(N)
- mpich-0001: group_lpid_to_rank O(N²) → HashMap O(N), 313x at N=1000
- ompi-0001: group_overlap process-name scan O(N×M) → HashMap O(N+M), 2048x
- pcl-0001: RegionGrowing::getSegmentFromPoint O(C×S) → point_labels[] O(1), 50000x

CLEAN confirmed: esbuild, express, koa, ktor, lucene, mpich-recvq, ompi-startup,
  prosody, roda, rust/rustc-wave2, signal-server, solana, wiredtiger, wireguard-tools,
  linux-kernel (pointer to linux/)

defects/wireguard-tools/patch/wireguard-tools-CLEAN.md

@@ -0,0 +1,40 @@
+# wireguard-tools CWE-407 Scan — CLEAN
+
+**Scan date:** 2026-03-29
+**Target:** WireGuard/wireguard-tools
+**Source root:** `src/`
+**Hot paths scanned:** config.c, wg.c, set.c, setconf.c, show.c, ipc.c
+
+## Summary
+
+No CWE-407 defects found. The codebase is a CLI tool (not a server). Peer lists are small
+by design (WireGuard limits to ~10,000 peers per interface), and all multi-peer operations
+use sort-then-merge rather than nested linear scans.
+
+## Findings
+
+### config.c — parse_allowedips / process_line / config_read_cmd
+No membership checks inside loops. AllowedIPs parsing builds a singly-linked list
+(`new_allowedip->next_allowedip = ...`) in O(N) with no deduplication scan.
+
+### setconf.c — sync_conf
+The only multi-peer algorithm: merges file-peers and runtime-peers to compute the delta.
+Uses `qsort(peers, peer_count, sizeof(*peers), peer_cmp)` then a single O(N) sorted merge.
+Total: O(N log N). Correct algorithm, no O(N²) pattern.
+
+### show.c — pretty_print / dump_print / ugly_print
+Nested `for_each_wgpeer { for_each_wgallowedip }` loops are pure rendering (printf).
+No membership test inside the inner loop. No deduplication. O(P×A) for output only.
+
+### wg.c — main dispatch
+Static subcommand array of 9 entries, linear scanned once per invocation.
+Constant time in practice (N=9 always).
+
+### ipc.c — ipc_list_devices
+Builds a null-delimited string buffer. No membership checks.
+
+## Conclusion
+
+wireguard-tools is clean for CWE-407. The tool is a thin CLI wrapper over the kernel
+WireGuard interface. All multi-peer operations are O(N log N) or pure output loops.
+No O(N²) membership checks found.