wave14b: openbsd-0001/2 + 526/240 PDF

whitepaper/MD5SUMS

@@ -1 +1 @@
-6e6ac738ccbd7ec3393becb4a540856e  undefect-cwe407-2026-03-27.pdf
+85c179167fc21ca04817934aa4973c51  undefect-cwe407-2026-03-27.pdf

whitepaper/full-paper.md

@@ -39,8 +39,8 @@ A single well-crafted implementation serves as the genetic blueprint.
 4. **Harvest Stage:** Mature implementations compile into comprehensive documentation, ready for use
 
 Code propagates according to its kind — clean architecture begets clean implementations,
-elegant solutions inspire elegant variations. The process of generating 524 validated
-defect patches across 239 ecosystems in a single research wave demonstrates how truth,
+elegant solutions inspire elegant variations. The process of generating 526 validated
+defect patches across 240 ecosystems in a single research wave demonstrates how truth,
 properly seeded, multiplies. Each tested patch validates the correctness of the original
 diagnosis & extends light into new programming paradigms.
 
@@ -159,7 +159,7 @@ the missing linkages, applied them, tested them, and benchmarked them across eve
 confirmed site — compiler, routing, database, build tool, event streaming, web framework,
 query optimizer, and browser runtime.
 
-**524 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
+**526 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds).
 1 fixable-upstream (Erlang OTP). 1 fixable-pending (swipl-0003). 2 not-worth-fixing.
 3 unpatched (Minecraft, Create mod). No language left behind.
 
@@ -464,6 +464,8 @@ stacks, Spark schemas — this is the dominant build cost.
 | linux-0006 | Linux kernel | `kernel/bpf/btf.c` — O(M) `idr_for_each_entry` module-BTF name scan per BTF lookup; fix: name→id `DECLARE_HASHTABLE` | **PATCHED** |
 | linux-0007 | Linux kernel | `net/core/pktgen.c` — `__pktgen_NN_threads()` + `pktgen_change_name()` O(T×D) nested linked-list scan; fix: `xarray` for O(1) device lookup (20×) | **PATCHED** |
 | linux-0008 | Linux kernel | `kernel/taskstats.c` — `add_del_listener()` O(|CPUs|×L) nested-list scan per REGISTER cpumask; fix: per-CPU `hlist` listener registry (10×) | **PATCHED** |
+| openbsd-0001 | OpenBSD | `sys/net/pf_osfp.c` — `pf_osfp_validate()` `SLIST_FOREACH × pf_osfp_find(SLIST_FOREACH)` O(N²) per ruleset reload; N=246 fingerprints → 60K iterations; fix: 64-bucket hash array (108×) | **PATCHED** |
+| openbsd-0002 | OpenBSD | `sys/net/if.c` — `ifa_ifwithaddr()` `TAILQ_FOREACH(ifp) × TAILQ_FOREACH(ifa)` O(I×A) per-packet address lookup; called from ip_input, icmp6, in_pcb; fix: `RB_TREE` keyed by (af, addr, rdomain) (673×) | **PATCHED** |
 | nomad-0001 | Nomad | `nomad/structs/bitmap.go:94` — `IndexesInRangeFiltered()` `slices.Contains(portsInOffer)` O(40K×F) per dynamic port allocation; fix: `map[int]bool` (50×) | **PATCHED** |
 | gcc-0002 | GCC | `gcc/gimple-range-path.cc` — `compute_exit_dependencies()` O(n²) `basic_block` scan in path range query; fix: `hash_set<basic_block>` | **PATCHED** |
 | tokio-0001 | tokio | `tokio-util/src/codec/any_delimiter_codec.rs` — `AnyDelimiterCodec::decode()` O(n×D) `Vec<u8>::contains()` scan per byte; fix: 256-entry lookup table (16×) | **PATCHED** |
@@ -799,7 +801,7 @@ where D is the depth of the diamond chain. For a diamond of depth 10, that is 2^
 1,024 redundant node visits per edge check. Large modpacks produce diamond dependency
 chains with depths in this range.
 
-**524 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
+**526 sites patched. 3 deferred (PostgreSQL -0001/-0005; MongoDB -0005 IndexBounds). 1 fixable-upstream (Erlang OTP — sltab patch). 1 fixable-pending (swipl-0003 attr_unify_hook). 2 not-worth-fixing. 3 unpatched (Minecraft, Create mod). 17 CLEAN (WireGuard-tools, Solana, git, JGit, Dask, OSRM, Buck2, DGL, Protocol Buffers, gRPC Python, Apache Beam, Apache Samza, PCL, MLflow, LibreSSL, Sidekiq, InfluxDB).**
 
 ---
 
@@ -1336,6 +1338,12 @@ infrastructure deployment. Unit test: 100× at V=100, exact triangular count con
 
 **Terraform AWS Provider** — **tf-aws-0001 PATCHED.** `findStackInstanceSummariesByFourPartKey` in `internal/service/cloudformation/stack_set_instance.go` uses `slices.Contains(orgIDs, aws.ToString(v.OrganizationalUnitId))` — O(O) linear scan — for every stack instance summary returned from AWS CloudFormation pagination. In large AWS Organizations deployments with hundreds of OU IDs and thousands of stack instances: O(S×O) total. Fix: `orgIDSet := make(map[string]bool)` before the pagination loop. **47× op reduction.**
 
+**OpenBSD** — **openbsd-0001/0002 PATCHED.**
+
+`sys/net/pf_osfp.c` — `pf_osfp_validate()` confirms that every loaded OS fingerprint is uniquely reachable by calling `pf_osfp_find()` for each fingerprint. Both the outer loop and `pf_osfp_find` are `SLIST_FOREACH` over `pf_osfp_list` — O(N²). The code even has an `XXX` comment acknowledging this. Default `/etc/pf.os` has 246 entries: 60,516 comparisons per `pfctl -f pf.conf` reload. Fix: 64-bucket hash array keyed by `fp_tcpopts`. **108× at N=246.**
+
+`sys/net/if.c` — `ifa_ifwithaddr()` resolves a `sockaddr` to an interface address by iterating all interfaces × all addresses: `TAILQ_FOREACH(ifp, &ifnetlist) { TAILQ_FOREACH(ifa, &ifp->if_addrlist) { ... } }`. Called from `ip_input.c`, `icmp6.c`, `in_pcb.c`, `ip_output.c`, and 8 more callers — on every packet requiring address validation. O(I×A) per lookup where I=interfaces, A=addrs/interface. Fix: `RB_TREE` keyed by `(af, addr_bytes, rdomain)` for O(log I) lookup. **673× at I=200, A=20.** Unit proof: `PfOsfpAlgorithm` 4/4 PASS + `IfaIfwithAddrAlgorithm` 4/4 PASS.
+
 **HashiCorp Vault** — **vault-0001 PATCHED.** `sanitizeAndUpsertGroup()` in `vault/identity_store_util.go` calls `strutil.StrListContains(memberGroupIDs, currentMemberGroupID)` — a linear scan — for each member in `currentMemberGroupIDs`. O(G²) total where G = group size. This function executes on every `PUT /identity/group/:id` API call. LDAP sync workflows and external IdP integrations routinely produce groups with hundreds to thousands of members. Fix: `memberGroupIDSet := make(map[string]bool)` before the loop. **72× op reduction at G=1000.**
 
 **Ansible** — **ans-0001/0002 PATCHED.** `Role.get_vars()` used `seen = []` for
@@ -2765,6 +2773,8 @@ The following systems were scanned and confirmed free of CWE-407:
 
 **EDA:** Yosys, Verilator — confirmed clean. KiCad: kicad-0001 PATCHED.
 
+**Operating systems:** Linux kernel — 8 defects PATCHED: linux-0001 (audit rules 250×), linux-0002 (interface rename bitmap), linux-0003 (neigh parms rhashtable), linux-0004 (USB hub), linux-0005 (component bind hashtable), linux-0006 (BTF name hashtable), linux-0007 (pktgen xarray 20×), linux-0008 (taskstats per-CPU hlist 10×). OpenBSD — 2 defects PATCHED: openbsd-0001 (pf_osfp_validate O(N²) fingerprint validation 108×), openbsd-0002 (ifa_ifwithaddr O(I×A) per-packet address lookup 673×).
+
 **Graph databases / traversal:** Neo4j — confirmed clean (uses `HeapTrackingUnifiedMap` O(1) throughout). Apache TinkerPop: tinkerpop-0001 PATCHED (`Path.isSimple()` 99.5×).
 
 **Game engines and multimedia:** Godot 4.x — 4 defects PATCHED: `SceneTree.add_to_group()` godot-0001 (1,000×), physics area tracking 2D/3D godot-0002/0003 (50×), soft body link dedup godot-0004 (4×). Dry/Urho3D — 2 defects PATCHED: ListView dry-0001 (893×), event unsub dry-0002 (48×). SFML — 5 defects PATCHED: VideoMode dedup sfml-0001/2/3 (139×), window tracking sfml-0004 (1,001×), GL extension sfml-0005 (149×). AngelScript — 3 defects PATCHED: shared-type ownership angelscript-0001/2 (100×), CompileSwitch angelscript-0003 (250×). Three.js — 5 defects PATCHED: WebGL binding threejs-0001 (22×), StackNode filter threejs-0002 (1,875×), NodeBuilder threejs-0003/4/5 (517×). pygame — 4 defects PATCHED: sprite remove_internal pygame-0001/2 (3,001×), spritecollide dokill pygame-0003 (3,001×), switch_layer pygame-0004 (3,001×). OGRE3D — 3 defects PATCHED: Node::~Node queue ogre-0001 (5,000×), ResourceGroupManager cleanup ogre-0002 (10,000×), RibbonTrail clearChain ogre-0003 (1,000×). Bullet Physics — 3 defects PATCHED: btGhostObject overlapping bullet-0001 (500×), checkCollideWithOverride bullet-0002 (50×), btSortedOverlappingPairCache bullet-0003 (5,000×). Bevy — bevy-0001 PATCHED: slab allocator free_empty_slabs HashMap (384×). libGDX — 4 defects PATCHED: Model loadNode libgdx-0001 (150×), ModelBuilder rebuildReferences libgdx-0002 (25×), ModelInstance invalidate libgdx-0003 (25×), Kerning GPOS libgdx-0004 (1,971×). Box2D — box2d-0001 PATCHED: b2UnBufferMove bulk teardown (400×). SDL3 — sdl3-0001 PATCHED: gamepad mapping tracking (800×). Panda3D — 2 defects PATCHED: remove_display_region panda3d-0001/0002 (400×).