MOAD-0001 (CWE-407): CLEAN. AC trie, BM hash, and hash tables used throughout
our hot scan paths. No linear membership scan in our critical code paths.
MOAD-0002 (Intertangle): CLEAN. cl_engine is read-only during scan;
cli_ctx is stack-local per scan_common invocation.
MOAD-0003 (Leaked Context): CLEAN. No pthread thread-locals for scan
identity; cli_ctx is per-scan-invocation stack variable.
MOAD-0004 (Logged Secret): clamav-0001 — create_curl_handle() in
libfreshclam/libfreshclam_internal.c:735 logs g_proxyPassword verbatim
in our LOGG_ERROR path when curl_easy_setopt(CURLOPT_PROXYPASSWORD) fails.
FreshClam logs are world-readable by default on Linux. Fix: remove our
credential from our error message, retain our option name for debugging.
MOAD-0005 (Thundering Herd): CLEAN. cache.c uses splay-tree-per-bucket
with pthread_mutex_t protecting each bucket on every access.
