wine: all 5 MOADs CLEAN (wine-0001 pre-existing); wireguard-go: all 5 MOADs CLEAN

Wine scan: hot paths use hash tables (module lookup), red-black trees (font
families, shader cache), binary search (registry), bounded lists (FBO<=64,
sampler<=16, MUI<=8). wine-0001 covers loader dependency dedup. No additional
CWE-407 defects. MOADs 0002-0005 CLEAN: loader_section is by design, no
request-scoped TLS leakage, kerberos logs only auth_data pointer (not value),
all caches protected by critical sections.

WireGuard-go scan: peers.keyMap is hash map O(1), AllowedIPs is radix trie O(32).
Private key and PSK are never logged (only "Updating X" labels). Device struct
has per-sub-struct sync.RWMutex with no thundering herd patterns. MOADs 0002-0005
CLEAN: well-decomposed Device struct, no goroutine-local leakage, proper sync.

defects/wine/patch/CLEAN.md

@@ -0,0 +1,99 @@
+CLEAN — Wine (wine-mirror/wine) — all 5 MOADs scanned 2026-03-31
+
+Repository: https://gitlab.winehq.org/wine/wine
+Mirror: https://github.com/wine-mirror/wine
+Version: HEAD (depth=1 clone)
+Language: C
+Size: 12,147 files
+
+Note: wine-0001 (UNDF-2026-000000886) covers MOAD-0001 loader dependency dedup
+in dlls/ntdll/loader.c. This marker covers the remaining 4 MOADs plus additional
+MOAD-0001 coverage confirming no other hot-path O(N^2) defects beyond wine-0001.
+
+## MOAD-0001 (CWE-407): wine-0001 filed; additional sites CLEAN
+
+Hot paths scanned:
+
+- dlls/ntdll/loader.c: find_basename_module uses hash_table (HASH_MAP_SIZE buckets),
+  find_named_export uses binary search (find_name_in_exports), loader dependency
+  dedup covered by wine-0001.
+
+- server/registry.c: find_subkey and find_value both use binary search on sorted
+  arrays. O(log N) per registry key/value lookup. CLEAN.
+
+- dlls/win32u/class.c: find_class uses LIST_FOR_EACH_ENTRY on class_list. The list
+  contains ~13 builtin classes plus app-registered classes. Called once per
+  CreateWindow, not in a loop over windows. In practice N < 50. The linear scan
+  is bounded and not O(N^2). CLEAN.
+
+- dlls/win32u/font.c: find_family_from_name and find_family_from_any_name both use
+  wine_rb_get (red-black tree). find_cached_gdi_font scans gdi_font_list with hash
+  precheck (fontcmp exits early on hash mismatch) — O(N) per CreateFont but not
+  O(N^2). get_gdi_font_subst called in add_gdi_font_subst at startup only (not
+  runtime hot path). CLEAN.
+
+- dlls/wined3d/glsl_shader.c: shader program cache uses wine_rb_tree (O(log N)),
+  FFP vertex/fragment shader caches use wine_rb_tree. shader_glsl_find_sampler
+  is O(S) where S = sampler count, bounded by D3D limits (S <= 16). CLEAN.
+
+- dlls/wined3d/context_gl.c: FBO cache is LIST_FOR_EACH_ENTRY capped at
+  WINED3D_MAX_FBO_ENTRIES=64. Bounded, not O(N^2). CLEAN.
+
+- dlls/kernelbase/registry.c: MUI cache is LIST_FOR_EACH_ENTRY capped at
+  REG_MUI_CACHE_SIZE=8. CLEAN.
+
+- dlls/secur32/secur32.c: security package table LIST_FOR_EACH_ENTRY is O(P)
+  where P = number of loaded SSP packages (typically < 10). Called per
+  QuerySecurityPackage, not per-request. CLEAN.
+
+## MOAD-0002 (Intertangle): NOTED, architectural
+
+dlls/ntdll/loader.c: loader_section is a single global RTL_CRITICAL_SECTION
+serializing all PE loader operations (LoadLibrary, FreeLibrary, DllMain calls).
+This creates a global bottleneck but is mandated by the Windows PE loader
+specification — simultaneous DLL loads from multiple threads must be serialized to
+prevent dependency race conditions. This is architectural constraint, not a novel
+defect.
+
+dlls/win32u: user_lock() serializes all USER32 object operations. Same pattern,
+same justification (Windows USER32 is single-threaded by design).
+
+No god-object coupling between independent subsystems (e.g., network + graphics +
+audio sharing mutable state) found. Wine DLLs are architecturally isolated.
+
+## MOAD-0003 (Leaked Context): CLEAN
+
+NtCurrentTeb() provides per-thread TEB (Thread Environment Block) carrying:
+- LastStatusValue, LastErrorValue (per-thread error codes — by design)
+- ActivationContextStack (COM/SxS context — by design)
+- tls_slots (TLS slots — explicitly managed by app)
+
+These are per-thread, not request-scoped identity carriers. No cross-request
+ThreadLocal leakage pattern found.
+
+dlls/kernelbase/locale.c uses NtCurrentTeb() for locale info — Windows API
+design, not a leaked context defect.
+
+## MOAD-0004 (Logged Secret): CLEAN
+
+dlls/kerberos/krb5_ap.c:
+- kerberos_SpAcquireCredentialsHandle TRACE logs auth_data as %p (pointer only,
+  not contents). Password extracted via get_password_unixcp() and passed to
+  init_creds() but never logged.
+- init_creds() in unixlib.c calls krb5_get_init_creds_password() with password
+  but logs only "success" on completion.
+
+dlls/secur32/wrapper.c: AcquireCredentialsHandle logs pAuthData as %p (pointer).
+No password/credential value appears in any TRACE/WARN/ERR call.
+
+## MOAD-0005 (Thundering Herd): CLEAN
+
+dlls/ntdll/loader.c: all module cache access (cached_modref) occurs under
+loader_section critical section. No unsynchronized check-then-act.
+
+dlls/win32u: all class_list access under user_lock(). No double-check locking.
+
+dlls/wined3d: GL context operations are per-thread (each thread has its own
+context_gl). No shared cache without synchronization found.
+
+server/ (wineserver): single-threaded event loop — no concurrent cache misses.