testcafe-0001: Selector filterNodes (string-filter branch) and
expandSelectorResults both dedup via Array.indexOf on growing result
arrays. filterNodes: O(N*M) per selector filter. expandSelectorResults:
O(N^2 * K^2) worst case when derivatives unique. Fix: Set<Node> keyed
by object identity. Bench: 398x at N=2000 filter, 1966x at N=K=150
expand.
webdriverio-0002: MSPO aggregator dedups per-test entries via Array.find
on growing bucket array. O(N^2) per test bucket, same pattern repeats
in unknown-suite merger. Fix: companion Map<bucketKey, Set<selector>>
for O(1) dedup. Bench: 493x at N=2000.
UNDF IDs: 1290 (testcafe), 1291 (webdriverio-0002). All 17 tests pass.
sqlite-0001 (checkColumnOverlap): 49x speedup at 200-col trigger, 50-col SET
sqlite-0003 (FK column resolution): 52x speedup at 500-col parent, 50-col FK
Scaling ratio 3.2x and 5.2x at 5x growth (linear, not quadratic).
Covers meson-0003 through meson-0006:
- Functional correctness: fixed regex matches original on representative inputs
- Adversarial performance gates per finding
- meson-0004 exponential-proof: original >50ms at n=20, fixed <1ms
Every patch now ships with a runnable benchmark verifying complexity claims:
- bleach/unit/test_bleach_cwe1333.py: length guard truncates 1001-char adversarial
input to 1000 chars (removes '@' tail), gauntlet matches fast (<0.5s)
- salt/unit/test_salt_cwe1333.py: ThreadPoolExecutor timeout wrapper tested at N=20
adversarial, GIL behavior documented
- ansible/unit/test_ansible_cwe1333.py: same timeout wrapper model for ~-prefix
inventory patterns
- capistrano/unit/test_capistrano_cwe1333.rb: Regexp.timeout= / Timeout fallback
guard for host/role filter patterns
- puppet/unit/test_puppet_cwe1333.rb: RegexGuard.safe_compile timeout for all
three Puppet regex call sites (match(), =~, PRegexpType)
- katago/unit/test_katago_cwe407.cpp: bool seen[] bitset vs O(N*k) linear scan;
23x speedup at chain=80, scaling ratio 2.5x at 3x chain size (limit 4x)
- pachi/unit/test_pachi_cwe362.c: 8-thread hammer, 100k iterations, zero
double-expansion events with __atomic_store_n fix
katago-0001-findliberties-bitset.patch (UNDF-2026-000000226)
CWE-407: O(N*k) liberty dup scan → O(N) bool seen[] bitset
Peak speedup: 25× on scattered chains
pachi-0001-atomic-is-expanded.patch (UNDF-2026-000001274)
CWE-362: is_expanded flag set before atom fully populated → races
lean4-0004: collapse 3-phase lock in ir_interpreter lookup_symbol to single unique_lock
lean4-0005: replace IO.Ref JobQueue with Std.Mutex in Lake job registry
lean4-0006: register thread-local reset for g_opts in kernel/trace.cpp
lean4-0007: build unordered_set of override keys outside env-var loop (Windows)
Salt pcre/grain_pcre targeting passes user-controlled regex to re.match/re.compile
without timeout. Ansible inventory manager passes tilde-prefixed host patterns
directly to re.compile. Both fixed with ThreadPoolExecutor 1s timeout wrapper.
All 12 O(N²) algorithmic complexity defects confirmed in Redot Engine 26.2-alpha
(commit 360a8d3). Inherited verbatim from Godot Engine upstream. All patched.
Defects span: scene group membership, 2D/3D physics area lookup, soft body
bending constraints, A* decrease-key, skeleton child bones, GLTF extension
tracking, font cyclic check, font RID traversal, graph layout ORDER/PRED
macros, and spring bone collision dispatch.
Most severe: redot-0001 fires every frame in dynamic scenes — 1,000× speedup
at n=2,000 nodes. redot-0002/0003 fire 60Hz in physics-heavy games — 50×.
Strategy: patch Redot first, Godot follows our lead.
systemd-0004: seccomp_load_syscall_filter_set() in src/shared/seccomp-util.c uses
strv_contains(added, name) — O(|added|) linear scan — inside NULSTR_FOREACH over
~537 KNOWN syscalls. On x86_64 (3 arches): ~484,000 string comparisons per service
start with SeccompFilter=. Sibling function seccomp_load_syscall_filter_set_raw()
already uses hashmap_contains for O(1); this function was left behind.
Fix: build Set* from added strv before the NULSTR_FOREACH loop. MEDIUM severity.
dbus-0001: bus_client_policy_optimize() in bus/policy.c iterates R rules and for
each blanket deny/allow calls remove_rules_by_type_up_to() which scans backward
from current position to head — O(R^2) total per new connection creation.
At R=100 rules (realistic system bus): ~10,000 comparisons per connect.
Fix: single O(R) reverse pass tracking last-seen blanket per rule type. MEDIUM.
dbus 5-MOAD summary:
MOAD-0001: dbus-0001 DEFECT (policy optimize O(R^2))
MOAD-0002: CLEAN (BusContext is standard daemon context, not a god object)
MOAD-0003: CLEAN (single-threaded event loop, no thread-local state)
MOAD-0004: CLEAN (_dbus_verbose is no-op in production builds)
MOAD-0005: CLEAN (pending_activations hash table coalesces duplicate requests)
Rescan both targets against all 5 MOADs (2026-04-03).
New defect:
- transformers-0004: wav2vec2, wav2vec2_phoneme, esm tokenizers call
self.all_special_ids/@property inside per-token decode loops, rebuilding
list every iteration. O(T) -> O(1) fix: cache set before loop.
wav2vec2_phoneme also has type mismatch (str vs list[int]), making
the check always False, leaking special tokens.
9/9 unit tests PASS.
Existing defects confirmed still present (not re-filed):
- transformers-0001/0002/0003: unchanged from 2026-03-31 scan.
- vllm-0001/0002: unchanged from 2026-03-31 scan.
MOAD-0002/0003/0004/0005: CLEAN on both targets (see SCAN-2026-04-03.md).
SCAN-TODO.md: marked transformers and vllm as complete with full summary.
Also includes UNDF stamps on jicofo-0001, jicofo-0002, langchain-0002 patches
from prior generate_undf.py run.
Ollama: all 5 MOADs scanned. MOAD-0001 ollama-0001 (pre-existing). MOADs 0002/0003/0004/0005 CLEAN
per defects/ollama/CLEAN.md (scanned 2026-03-31).
LangChain: all 5 MOADs scanned. New defect langchain-0002 MOAD-0001 CWE-407.
- multi_query.py _unique_documents: `doc not in documents[:i]` creates O(D) slice each iteration
and performs O(D) linear scan, giving O(D^2) overall. D = Q*k where Q=queries, k=results per query.
- Fix: seen set with hashable proxy key (id, page_content, str(metadata items)). O(D) total.
- 9/9 unit tests PASS, 21.4x speedup at D=500.
MOADs 0002/0003/0004/0005 CLEAN per updated defects/langchain/CLEAN.md.
SCAN-TODO.md: mark both targets [x].
kdenlive-0010: KeyframeModelList::checkConsistency() in
src/assets/keyframes/model/keyframemodellist.cpp calls QList<GenTime>::contains()
inside nested loops — O(P*K^2) at clip load for multi-parameter keyframe effects.
Fix: std::set<GenTime> using operator< for O(log K) insert/lookup in both phases.
Speedup: 50x at K=100, 250x at K=500, 500x at K=1000 (P=3 params). 12/12 PASS.
Audacity: full 5-MOAD rescan on fresh clone confirms prior scan results.
No new defects. MOADs 0002/0003/0004/0005 CLEAN.
scribus-0004: scribus{150,170,171}format_save.cpp writes styles via
names.contains() on QList<QString> (from QMap::keys()) inside O(S) loop
— O(S²) per save. Fix: use lists.charStyles().contains() (QMap, O(log N))
directly. 6 defect sites across 3 format variants. 375x at N=1000.
darktable: 5-MOAD scan complete (darktable-0001..0005 + MOAD-0002/0003/0005
CLEAN already committed). No new defects found beyond prior scan.
SCAN-TODO: mark both targets as scanned with summary.
