freecad/retroarch/mpv: CWE-407 scan — 3 defects, mpv CLEAN

freecad-0001: ifc_generator.py done-list O(N^2) dedup MEDIUM-HIGH 499x
freecad-0002: importDXF.py processededges list O(E^2) MEDIUM 469x
retroarch-0001: playlist_entry_exists O(R*P) linear scan in content scanner HIGH 749x
mpv: CLEAN (all data structures naturally bounded)

3/3 unit tests PASS.

defects/mpv/patch/CLEAN.md

@@ -0,0 +1,25 @@
+# mpv: CWE-407 scan result — CLEAN
+
+Scanned 2026-03-30.
+
+## Areas inspected
+
+- `player/` — playlist, command, loadfile, external_files, client
+- `options/` — m_config_core, m_config_frontend, m_property, m_option
+- `filters/` — f_output_chain, filter, f_lavfi, f_decoder_wrapper
+- `demux/` — demux_timeline (stream mapping), demux_mkv (track matching)
+- `input/` — input bindings, section management
+- `common/` — playlist.c
+
+## Findings
+
+mpv uses small, bounded data structures throughout:
+- Playlists: no dedup/membership checks (just appends)
+- Filter chains: typically <10 filters
+- Input bindings: <100 per section
+- Media tracks: <20 per file
+- Option lists: ~300-500 (compile-time constant)
+- Client list: <10
+
+All linear scans operate on data sets with natural bounds well below the
+threshold where O(N^2) matters. No CWE-407 defects found.