openmsx-0001: MSXCPUInterface::checkBreakPoints() O(B) linear scan
over all breakpoints per Z80 instruction when any breakpoint is active.
Fix: unordered_map<uint16_t, vector<id>> index gives O(k) lookup where
k = breakpoints at current PC (typically 0). 500x improvement at B=500.
desmume-0001: armInnerLoop scans breakPoints std::vector<u32> linearly
O(B) on every ARM9 and ARM7 instruction (~66+33 MHz); replace with
std::unordered_set<u32> for O(1) lookup. 3.5x speedup at B=32. MOAD 0002-0005 CLEAN.
melonds-0001: GPU3D_Soft RenderScanline iterates all P polygons per
scanline O(P*S) per frame; active-list sweep gives O(P log P + A_total).
9x speedup at P=2048 with typical short-lived polygons. MOAD 0002-0005 CLEAN.
CWE-407: key dispatch uses 2-level array O(1), no list scan in hot paths;
breakpoints patched into JIT code (not per-instruction scan); controller
info heuristics O(N) only on hotplug event (not emulation loop). MOAD 0002:
current_system is expected single-emulator global. MOAD 0003: C codebase,
no ThreadLocal. MOAD 0004: megawifi stub strings are placeholders, not real
credential logging. MOAD 0005: no unsynchronized cache patterns found.
genesis-plus-gx-0001: retro_cheat_set duplicate cheat detection uses
O(N) linear scan over cheatlist[0..maxcheats-1] for every code added,
producing O(N^2) total cost when loading a full cheat file (MAX_CHEATS=150).
Fix: open-addressing hash table keyed by (address, data), O(1) per insert.
9x speedup measured at N=150.
dolphin-0001: BreakPoints::GetRegularBreakpoint O(N) std::ranges::find
over m_breakpoints vector, called per CPU instruction when breakpoints
are active. Fix: unordered_map<u32, size_t> index rebuilt on mutation,
O(1) lookup. 2.5x speedup at N=64, scales further with breakpoint count.
vice-0001: monitor breakpoint list O(N) scan per opcode — search_checkpoint_list
traverses sorted checkpoint linked list without early exit. Code comment promises
"we can drop out early" but never implements it. Fix: break when entry.start_addr
exceeds target address. 200x fewer comparisons for addresses below first breakpoint.
11/11 PASS.
DOSBox-X: dosbox-x-0001/0002 previously committed (2026-03-31). MOAD 0002-0005 CLEAN.
fbneo-0001: BurnDrvGetIndex O(N) linear scan over 24493 drivers -> O(1) unordered_map,
91x speedup at N=5000. Fix: hash index built at BurnLibInit, cleared at BurnLibExit.
mame: confirmed CLEAN on all 5 MOADs (binary search for driver lookup, single-threaded).
MOAD-0001 (CWE-407): Nestopia uses std::lower_bound (binary search, sorted
array) for cheat code lookup in NstCheats.cpp -- already O(log N). Input
mapping in fltkui/inputmanager.cpp uses hash maps (jbmap/jhmap/jamap keyed
by port*100+inum) -- O(1). No linear scan inside any hot loop found.
MOAD-0002: Subsystems communicate through typed API layers (Cpu::Link,
Cpu::Unlink, NES_PEEK_A/NES_POKE_AD macros). No shared god-object mutable
global state coupling found.
MOAD-0003: No ThreadLocal or thread-scoped identity carriers found.
Single-threaded emulation core.
MOAD-0004: No netplay or credential handling in core or fltkui. No logging
of secrets found.
MOAD-0005: No cache get+null+compute+put race patterns found. CLEAN.
MOAD-0001 (CWE-407): SubCheatsRead in src/cheat.cpp scans all C active
cheats linearly on every NES memory read at any cheat address. O(C) per
read, C up to 256. Fix: cheat_idx[0x10000] direct address lookup, O(1).
Unit test: 74.7x speedup at C=256. 1/1 PASS.
MOAD-0002: Global mutable state (SubCheats[], ARead[], CheatRPtrs[])
couples cheat, PPU, CPU subsystems -- expected single-threaded NES
architecture, not an actionable intertangle defect.
MOAD-0003: thread_local in profiler.cpp (per-thread profiling data) and
QtScriptManager.cpp (per-JS-engine context pointer) -- legitimate
thread-local scoping, not a leaked request context carrier.
MOAD-0004: NetPlay.cpp line 788 logs netplay session password verbatim
via printf("Authorize: Player: %i Passwd: %s\n", msg->playerId,
msg->pswd). Debug printf, no patch created per scan protocol (0001 only).
MOAD-0005: No cache get+null+compute+put races found. CLEAN.
https://github.com/sinamas/gambatte returns a placeholder README only:
"This project has been taken private." No source available to scan.
All 5 MOADs: UNSCANNED, source unavailable.
sameboy-0001: test_watchpoint() O(W) linear scan per GB memory read/write.
Every call to GB_read_memory / GB_write_memory scans all watchpoints when
n_watchpoints > 0. Fix: watchpoint_address_flags[0x10000] lookup table gives
O(1) early exit; 128x speedup at W=128.
sameboy-0002: should_break() O(B) linear scan per CPU instruction fetch.
GB_debugger_run() calls should_break() every instruction when debug_active.
Fix: breakpoint_address_set[0x10000] boolean table gives O(1) early exit;
128x speedup at B=128.
MOAD-0002: CLEAN, gb struct passed explicitly, no shared global state.
MOAD-0003: CLEAN, __thread only used for local string formatting buffers.
MOAD-0004: CLEAN, no network credentials logged.
MOAD-0005: CLEAN, no unsynchronized cache patterns found.
MOAD-0001 CWE-407: CLEAN. No hot-path linear scans found.
- BreakpointManager uses pre-bucketed vector indexed by MemoryOperationType, O(1) dispatch
- CheatManager uses unordered_map keyed by address, O(1) lookup per read
- LabelManager uses unordered_map keyed by address+type, O(1) lookup
- FrozenAddressManager uses unordered_set, O(1) lookup
- ProfilerManager uses unordered_map keyed by function address, O(1) lookup
- ExpressionEvaluator RPN cache uses mutex-protected unordered_map, O(1) lookup
- All std::find occurrences are on cold paths (ROM load, controller enumeration, startup)
- KeyCombination.IsSubsetOf uses std::find on a max-3-element vector, trivially bounded
MOAD-0002 Intertangle: CLEAN. Clean subsystem interfaces.
- KeyManager, CheatManager, LabelManager, BreakpointManager all hold explicit
Debugger/Emulator pointers rather than accessing shared global state directly.
- No god objects detected.
MOAD-0003 Leaked Context: CLEAN.
- thread_local _currentThreadId in Emulator is used only to detect if caller is
the emulation thread. It carries no request-scoped identity and does not leak
across call contexts.
MOAD-0004 CWE-312: CLEAN.
- Netplay password is SHA1-hashed with a 50-char random nonce before transmission.
- No password or credential value reaches any Log or DisplayMessage call.
MOAD-0005 Thundering Herd: CLEAN.
- ExpressionEvaluator cache is guarded by _cacheLock (SimpleLock) on both read and write.
- No unprotected get+null+compute+put patterns found.
samba-0001: security_token_has_sid O(A*S) in se_access_check
- security_token_has_sid() does O(S) linear scan over token SIDs
- called inside O(A) ACE loop in se_access_check_implicit_owner()
- O(A*S) per file access; S=200 groups, A=20 ACEs = 4000 comparisons
- fix: sort token->sids[2..] at finalization, use bsearch for O(log S)
- 9.5x measured speedup (S=200, A=20); up to 26x at S=200, A=50
- hot path: called on every smbd file open / access check
samba-0002: security_token_create O(N^2) SID dedup (source4 AD DC path)
- nested for-loop in security_token_create deduplicates SIDs O(N^2)
- Kerberos PAC with 500 group SIDs: ~125,000 dom_sid_equal() calls/login
- at MS-KILE 1015-SID limit: ~515,000 calls per DC login
- fix: binary insertion sort scratch array for O(N log N) dedup
- 5.7x speedup at N=500, 9.3x at N=1000 (near PAC limit)
- also applies security_token_sort_sids() after token build
MOAD-0002: smbd is single-threaded event loop, global state is by design
MOAD-0003: no thread-local credential storage found
MOAD-0004: all sensitive dumps guarded by #ifdef DEBUG_PASSWORD compile flag
MOAD-0005: all caches TDB-synchronized or single-threaded event loop
MOAD-0001 (CWE-407): filterMetrics() in allocate.go calls containsPeer()
(linear scan) three times per metric in our inner loop — once for blacklist,
once for currentAllocs, once for priorityList. With M metrics and B+C+P
total peer-list entries, each allocation decision costs O(M*(B+C+P)).
Fix: Build map[peer.ID]struct{} sets before our loop. Each lookup becomes O(1).
At scale (200 peers, 100-entry lists): ~60x fewer comparisons.
MOAD-0002 (intertangle): allocation state passed as function args, no globals. CLEAN.
MOAD-0003 (leaked context): no ThreadLocal or goroutine-scoped carriers. CLEAN.
MOAD-0004 (logged secret): peer IDs logged, no auth tokens or private keys. CLEAN.
MOAD-0005 (thundering herd): allocation runs under consensus lock. CLEAN.
lotus-0001: eventFilter.matchAddress() slices.Contains O(A) per event,
replace with map[address.Address]struct{} for O(1) lookup; 28.6x at A=100,
225x at A=1000; no limit enforced on Addresses in EthFilterSpec
nfs-utils-0001: client_lookup() non-FQDN branch O(N) linked list
scan per call in support/export/client.c:289. With N unique
wildcard/netgroup/subnet clients, export_read totals O(N^2).
Fix: hash table for hostname lookup. 119x at N=4000.
nfs-utils-0002: get_exportlist() in utils/mountd/mountd.c,
lookup_or_create_elist_entry O(E) path scan + insert_group
O(G) dedup scan, both per export = O(E^2) total. Fix: hash
tables for path lookup and group dedup. 73x at N=4000.
MOAD-0002 (intertangle): clientlist/exportlist globals are standard
single-threaded daemon design, single execution context. CLEAN.
MOAD-0003 (leaked context): no __thread or pthread_getspecific. CLEAN.
MOAD-0004 (logged secret): gssd logs keytab paths and principal
names (not credentials). No key material logged. CLEAN.
MOAD-0005 (thundering herd): caches protected by ple_lock mutex
in gssd, single-threaded event loop in mountd. CLEAN.
