networkmanager+avahi: 5-MOAD scan CLEAN

Both targets scanned across all 5 MOADs. No defects found.

NetworkManager: single-threaded GLib main loop, no hot-path O(N^2) scans,
all WiFi PSK/EAP/VPN secrets guarded with "<hidden>" in supplicant config log.

avahi: single-threaded poll loop, hashmap-based record and lookup caching,
no credentials, no thread-local context, no concurrent cache patterns.

defects/avahi-scan/CLEAN.md

@@ -0,0 +1,45 @@
+# avahi — 5-MOAD Scan — CLEAN
+
+**Date:** 2026-03-31
+**Repo:** https://github.com/avahi/avahi (depth=1)
+**Scanned:** avahi-core/, avahi-daemon/
+
+## MOAD-0001 (CWE-407) — CLEAN
+
+No O(N^2) linear scan patterns in hot packet-processing paths.
+
+Patterns examined:
+
+- `avahi_cache_update()` — uses `avahi_hashmap_lookup()` for O(1) key lookup. Clean.
+- `avahi_multicast_lookup_engine_notify()` — uses `avahi_hashmap_lookup()` for normal records;
+  falls back to linear scan only for CNAME records (rare special case). Acceptable.
+- `avahi_interface_is_relevant()` — scans `deny_interfaces` / `allow_interfaces` config lists.
+  These are static configuration lists, typically 0-3 entries. O(L) where L is tiny. Not a
+  per-packet amplification.
+- `reflect_filters` scan in `handle_response_packet()` — small static config list.
+  O(R * F) where R = records per packet, F = filter count (0-3 in practice). Not amplified.
+- `avahi_string_list_find()` in `entry.c:add_magic_cookie()` — one-shot call per service
+  registration. Not in a hot loop.
+- `find_slot()` in legacy unicast reflection — uses modulo hash (array indexed by id % MAX).
+  O(1). Clean.
+
+## MOAD-0002 (Intertangle) — CLEAN
+
+`AvahiServer` struct (in `avahi-core/internal.h`) holds all subsystem state as expected for
+an mDNS daemon. Clean separation: cache, entry groups, lookup engines, interface monitor are
+distinct components with clear interfaces. No pathological god-object coupling.
+
+## MOAD-0003 (Leaked Context) — CLEAN
+
+No thread-local storage found in avahi-core or avahi-daemon. avahi is single-threaded
+(poll-based event loop).
+
+## MOAD-0004 (CWE-312) — CLEAN
+
+avahi is an mDNS/DNS-SD daemon with no credential concepts (no passwords, PSKs, or tokens).
+No credential logging found in avahi-core or avahi-daemon.
+
+## MOAD-0005 (Thundering Herd) — CLEAN
+
+avahi is single-threaded (GLib poll_api event loop). No concurrent cache access patterns.
+No mutex or thread primitives found in avahi-core.

defects/networkmanager-scan/CLEAN.md

@@ -0,0 +1,61 @@
+# NetworkManager — 5-MOAD Scan — CLEAN
+
+**Date:** 2026-03-31
+**Repo:** https://github.com/NetworkManager/NetworkManager (depth=1)
+**Scanned:** src/core/, src/core/devices/, src/core/dns/, src/core/supplicant/, src/core/vpn/
+
+## MOAD-0001 (CWE-407) — CLEAN
+
+No O(N^2) linear scan patterns in hot paths.
+
+Patterns examined:
+
+- `nm_utils_g_slist_find_str` in `nm-settings.c:update_specs()` — called on plugin config-change
+  events (rare), not per-packet. P=plugins (2-3), S=specs (small). Not a hot path.
+- `g_slist_find` in `nm-device-factory.c:nm_device_factory_manager_for_each_factory()` —
+  factory init/dedup, runs once at startup.
+- `nm_strv_ptrarray_contains` in `nm-l3-config-data.c` for nameserver/domain/search dedup —
+  called per config-change on O(4) typical lists. Not a hot path.
+- `nm_strv_find_first` in `nm-bond-manager.c` — already acknowledged as O(N^2) in a code
+  comment; applies only to bond member reordering, not a per-packet hot path.
+- DNS manager (`nm-dns-manager.c`) uses `g_hash_table` for domain dedup. Clean.
+- Supplicant config (`nm-supplicant-config.c`) uses `g_hash_table` for option storage. Clean.
+
+## MOAD-0002 (Intertangle) — CLEAN
+
+`nm-manager.c` is large (9992 lines) but represents normal single-daemon architecture for
+a Linux network manager. No pathological shared-mutable-global-state coupling detected across
+independent subsystems that would qualify as an Intertangle defect.
+
+## MOAD-0003 (Leaked Context) — CLEAN
+
+Thread-local usage found:
+
+- `_nm_utils_to_string_buffer` — formatting scratch buffer. Correct use.
+- `_nm_utils_inet_ntop_buffer` — inet formatting buffer. Correct use.
+- `_netns_stack` in `nmp-netns.c` — network namespace push/pop stack. Intentionally
+  thread-local for safe per-thread namespace management. Not request-scoped identity leakage.
+- `_tls_reg_key` in `nm-shared-utils.c` — TLS destructor registration. Infrastructure.
+
+No request-scoped identity stored in thread-local context that outlives our request.
+
+## MOAD-0004 (CWE-312) — CLEAN
+
+All credential values are guarded with `"<hidden>"` display_value in
+`nm_supplicant_config_add_option*()`:
+
+- WEP keys: `"<hidden>"` at all call sites.
+- WPA PSK (passphrase + hex): `"<hidden>"`.
+- SAE password: `"<hidden>"`.
+- LEAP password: `"<hidden>"`.
+- EAP password: `"<hidden>"`.
+- SIM PIN: `"<hidden>"`.
+- Private key password: `"<hidden>"`.
+- MKA CAK: `"<hidden>"`. MKA CKN logged as hex string (key name, not key material).
+
+VPN secrets are passed via GVariant dicts and never logged verbatim.
+
+## MOAD-0005 (Thundering Herd) — CLEAN
+
+NetworkManager is single-threaded (GLib main loop). Only one mutex found
+(`nmtst_host_id_lock`) in test infrastructure. No concurrent cache get+compute+put patterns.