dosbox-x: 2 CWE-407 defects (jtbs/dbox O(N²) text select, bdlist O(N²) DBCS convert); higan: all 5 MOADs CLEAN

defects/higan/scan

@@ -0,0 +1,29 @@
+CLEAN
+
+MOAD-0001 (CWE-407): CLEAN
+  - Emulation cores (SFC/SNES, FC/NES, GBA, WonderSwan, NGP, MD, PCE, MS)
+    use fixed-size arrays indexed by sprite/object number for per-scanline
+    and per-pixel paths. No list membership checks in hot render loops.
+  - nall vector::find (linear O(N)) is called only in setup/attach paths
+    (Screen::attach, Scheduler::append, node::remove) — bounded by small
+    constant counts (sprites ~8, scheduler threads ~4). Not O(N^2).
+  - icarus ROM database lookup: O(N_games) linear scan per ROM import — not
+    O(N^2), just a single pass through 1162 SNES entries or ~500 GBA entries.
+  - GBA heuristic scan: 7 identifiers x ROM_bytes x list.find (max 7 entries)
+    = O(7 * D * 7). list stays bounded to num identifiers. Not O(N^2).
+
+MOAD-0002 (Intertangle): CLEAN
+  - higan uses global CPU/PPU/APU/Bus objects by design for emulation accuracy.
+    This is intentional coupling, not an accidental god-object defect.
+
+MOAD-0003 (Leaked Context): CLEAN
+  - No thread_local or TLS usage found. higan uses cooperative coroutines
+    (libco) for emulator threads — no OS thread-local context leakage.
+
+MOAD-0004 (CWE-312): CLEAN
+  - No credentials, tokens, passwords, or secrets are logged or persisted.
+    higan handles only ROM data and save states — no network authentication.
+
+MOAD-0005 (Thundering Herd): CLEAN
+  - Single-threaded cooperative scheduler. No concurrent cache access patterns.
+    All state mutation is deterministic and synchronous within scheduler turns.