CWE-407: key dispatch uses 2-level array O(1), no list scan in hot paths;
breakpoints patched into JIT code (not per-instruction scan); controller
info heuristics O(N) only on hotplug event (not emulation loop). MOAD 0002:
current_system is expected single-emulator global. MOAD 0003: C codebase,
no ThreadLocal. MOAD 0004: megawifi stub strings are placeholders, not real
credential logging. MOAD 0005: no unsynchronized cache patterns found.
genesis-plus-gx-0001: retro_cheat_set duplicate cheat detection uses
O(N) linear scan over cheatlist[0..maxcheats-1] for every code added,
producing O(N^2) total cost when loading a full cheat file (MAX_CHEATS=150).
Fix: open-addressing hash table keyed by (address, data), O(1) per insert.
9x speedup measured at N=150.
dolphin-0001: BreakPoints::GetRegularBreakpoint O(N) std::ranges::find
over m_breakpoints vector, called per CPU instruction when breakpoints
are active. Fix: unordered_map<u32, size_t> index rebuilt on mutation,
O(1) lookup. 2.5x speedup at N=64, scales further with breakpoint count.
vice-0001: monitor breakpoint list O(N) scan per opcode — search_checkpoint_list
traverses sorted checkpoint linked list without early exit. Code comment promises
"we can drop out early" but never implements it. Fix: break when entry.start_addr
exceeds target address. 200x fewer comparisons for addresses below first breakpoint.
11/11 PASS.
DOSBox-X: dosbox-x-0001/0002 previously committed (2026-03-31). MOAD 0002-0005 CLEAN.
fbneo-0001: BurnDrvGetIndex O(N) linear scan over 24493 drivers -> O(1) unordered_map,
91x speedup at N=5000. Fix: hash index built at BurnLibInit, cleared at BurnLibExit.
mame: confirmed CLEAN on all 5 MOADs (binary search for driver lookup, single-threaded).
MOAD-0001 (CWE-407): Nestopia uses std::lower_bound (binary search, sorted
array) for cheat code lookup in NstCheats.cpp -- already O(log N). Input
mapping in fltkui/inputmanager.cpp uses hash maps (jbmap/jhmap/jamap keyed
by port*100+inum) -- O(1). No linear scan inside any hot loop found.
MOAD-0002: Subsystems communicate through typed API layers (Cpu::Link,
Cpu::Unlink, NES_PEEK_A/NES_POKE_AD macros). No shared god-object mutable
global state coupling found.
MOAD-0003: No ThreadLocal or thread-scoped identity carriers found.
Single-threaded emulation core.
MOAD-0004: No netplay or credential handling in core or fltkui. No logging
of secrets found.
MOAD-0005: No cache get+null+compute+put race patterns found. CLEAN.
MOAD-0001 (CWE-407): SubCheatsRead in src/cheat.cpp scans all C active
cheats linearly on every NES memory read at any cheat address. O(C) per
read, C up to 256. Fix: cheat_idx[0x10000] direct address lookup, O(1).
Unit test: 74.7x speedup at C=256. 1/1 PASS.
MOAD-0002: Global mutable state (SubCheats[], ARead[], CheatRPtrs[])
couples cheat, PPU, CPU subsystems -- expected single-threaded NES
architecture, not an actionable intertangle defect.
MOAD-0003: thread_local in profiler.cpp (per-thread profiling data) and
QtScriptManager.cpp (per-JS-engine context pointer) -- legitimate
thread-local scoping, not a leaked request context carrier.
MOAD-0004: NetPlay.cpp line 788 logs netplay session password verbatim
via printf("Authorize: Player: %i Passwd: %s\n", msg->playerId,
msg->pswd). Debug printf, no patch created per scan protocol (0001 only).
MOAD-0005: No cache get+null+compute+put races found. CLEAN.
https://github.com/sinamas/gambatte returns a placeholder README only:
"This project has been taken private." No source available to scan.
All 5 MOADs: UNSCANNED, source unavailable.
sameboy-0001: test_watchpoint() O(W) linear scan per GB memory read/write.
Every call to GB_read_memory / GB_write_memory scans all watchpoints when
n_watchpoints > 0. Fix: watchpoint_address_flags[0x10000] lookup table gives
O(1) early exit; 128x speedup at W=128.
sameboy-0002: should_break() O(B) linear scan per CPU instruction fetch.
GB_debugger_run() calls should_break() every instruction when debug_active.
Fix: breakpoint_address_set[0x10000] boolean table gives O(1) early exit;
128x speedup at B=128.
MOAD-0002: CLEAN, gb struct passed explicitly, no shared global state.
MOAD-0003: CLEAN, __thread only used for local string formatting buffers.
MOAD-0004: CLEAN, no network credentials logged.
MOAD-0005: CLEAN, no unsynchronized cache patterns found.
MOAD-0001 CWE-407: CLEAN. No hot-path linear scans found.
- BreakpointManager uses pre-bucketed vector indexed by MemoryOperationType, O(1) dispatch
- CheatManager uses unordered_map keyed by address, O(1) lookup per read
- LabelManager uses unordered_map keyed by address+type, O(1) lookup
- FrozenAddressManager uses unordered_set, O(1) lookup
- ProfilerManager uses unordered_map keyed by function address, O(1) lookup
- ExpressionEvaluator RPN cache uses mutex-protected unordered_map, O(1) lookup
- All std::find occurrences are on cold paths (ROM load, controller enumeration, startup)
- KeyCombination.IsSubsetOf uses std::find on a max-3-element vector, trivially bounded
MOAD-0002 Intertangle: CLEAN. Clean subsystem interfaces.
- KeyManager, CheatManager, LabelManager, BreakpointManager all hold explicit
Debugger/Emulator pointers rather than accessing shared global state directly.
- No god objects detected.
MOAD-0003 Leaked Context: CLEAN.
- thread_local _currentThreadId in Emulator is used only to detect if caller is
the emulation thread. It carries no request-scoped identity and does not leak
across call contexts.
MOAD-0004 CWE-312: CLEAN.
- Netplay password is SHA1-hashed with a 50-char random nonce before transmission.
- No password or credential value reaches any Log or DisplayMessage call.
MOAD-0005 Thundering Herd: CLEAN.
- ExpressionEvaluator cache is guarded by _cacheLock (SimpleLock) on both read and write.
- No unprotected get+null+compute+put patterns found.
samba-0001: security_token_has_sid O(A*S) in se_access_check
- security_token_has_sid() does O(S) linear scan over token SIDs
- called inside O(A) ACE loop in se_access_check_implicit_owner()
- O(A*S) per file access; S=200 groups, A=20 ACEs = 4000 comparisons
- fix: sort token->sids[2..] at finalization, use bsearch for O(log S)
- 9.5x measured speedup (S=200, A=20); up to 26x at S=200, A=50
- hot path: called on every smbd file open / access check
samba-0002: security_token_create O(N^2) SID dedup (source4 AD DC path)
- nested for-loop in security_token_create deduplicates SIDs O(N^2)
- Kerberos PAC with 500 group SIDs: ~125,000 dom_sid_equal() calls/login
- at MS-KILE 1015-SID limit: ~515,000 calls per DC login
- fix: binary insertion sort scratch array for O(N log N) dedup
- 5.7x speedup at N=500, 9.3x at N=1000 (near PAC limit)
- also applies security_token_sort_sids() after token build
MOAD-0002: smbd is single-threaded event loop, global state is by design
MOAD-0003: no thread-local credential storage found
MOAD-0004: all sensitive dumps guarded by #ifdef DEBUG_PASSWORD compile flag
MOAD-0005: all caches TDB-synchronized or single-threaded event loop
MOAD-0001 (CWE-407): filterMetrics() in allocate.go calls containsPeer()
(linear scan) three times per metric in our inner loop — once for blacklist,
once for currentAllocs, once for priorityList. With M metrics and B+C+P
total peer-list entries, each allocation decision costs O(M*(B+C+P)).
Fix: Build map[peer.ID]struct{} sets before our loop. Each lookup becomes O(1).
At scale (200 peers, 100-entry lists): ~60x fewer comparisons.
MOAD-0002 (intertangle): allocation state passed as function args, no globals. CLEAN.
MOAD-0003 (leaked context): no ThreadLocal or goroutine-scoped carriers. CLEAN.
MOAD-0004 (logged secret): peer IDs logged, no auth tokens or private keys. CLEAN.
MOAD-0005 (thundering herd): allocation runs under consensus lock. CLEAN.
lotus-0001: eventFilter.matchAddress() slices.Contains O(A) per event,
replace with map[address.Address]struct{} for O(1) lookup; 28.6x at A=100,
225x at A=1000; no limit enforced on Addresses in EthFilterSpec
nfs-utils-0001: client_lookup() non-FQDN branch O(N) linked list
scan per call in support/export/client.c:289. With N unique
wildcard/netgroup/subnet clients, export_read totals O(N^2).
Fix: hash table for hostname lookup. 119x at N=4000.
nfs-utils-0002: get_exportlist() in utils/mountd/mountd.c,
lookup_or_create_elist_entry O(E) path scan + insert_group
O(G) dedup scan, both per export = O(E^2) total. Fix: hash
tables for path lookup and group dedup. 73x at N=4000.
MOAD-0002 (intertangle): clientlist/exportlist globals are standard
single-threaded daemon design, single execution context. CLEAN.
MOAD-0003 (leaked context): no __thread or pthread_getspecific. CLEAN.
MOAD-0004 (logged secret): gssd logs keytab paths and principal
names (not credentials). No key material logged. CLEAN.
MOAD-0005 (thundering herd): caches protected by ple_lock mutex
in gssd, single-threaded event loop in mountd. CLEAN.
s3fs-fuse-0001: StatCache::RawGetChildStats() dedup uses std::find()
on std::vector<std::string> inside loop over childmap. O(N*M) on every
readdir() and rename_directory() call. Fix: unordered_set for O(1)
lookup. MEDIUM severity, 13.8x at N=2000/M=1000.
MOAD-0002 (intertangle): globals are config-only, set at startup.
Subsystems (stat cache, fd cache, curl) are properly isolated
behind singleton + mutex. CLEAN.
MOAD-0003 (leaked context): no thread_local usage found. CLEAN.
MOAD-0004 (logged secret): all credential logging uses
mask_sensitive_string(). insecure_logging is opt-in and deprecated.
CLEAN.
MOAD-0005 (thundering herd): stat cache uses std::mutex properly.
curl handle pool uses lock_guard. No unprotected cache paths. CLEAN.
Hostage pathfinding CLocalNav::FindPath() calls NodeExists() inside BFS
expansion loop. NodeExists() linearly scans all existing nodes to check
if coordinate pair already exists. With MAX_NODES=100, this is O(N^2)
per FindPath() call (8 AddPathNode calls per expansion, each scanning
all N nodes).
Fix: unordered_set keyed on packed (offsetX, offsetY) for O(1) lookup.
Reduces FindPath() from O(N^2) to O(N). 31.1x op-count reduction at
N=100, 4/4 PASS.
MOAD-0002 (intertangle): gpGlobals is standard GoldSrc engine state, CLEAN.
MOAD-0003 (leaked context): single-threaded game DLL, no thread_local, CLEAN.
MOAD-0004 (logged secret): no RCON/auth handling in game DLL, CLEAN.
MOAD-0005 (thundering herd): single-threaded, no concurrent cache, CLEAN.
Space flight simulator with clean data structure discipline.
No CWE-407 on hot paths. Docking uses one-vessel-per-frame
amortized scan. MOAD-0002 present (47+ files coupled through
global mutable state) but architectural, not patchable.
regamedll-0001: BotProfileManager::GetRandomProfile calls UTIL_IsNameTaken
O(C) per profile in loop over all profiles O(P), yielding O(P*C*2) string
comparisons. Fix: build taken-name set once O(C), check O(1) per profile.
19.8x at P=100/C=32, 4/4 PASS.
simutrans-0001: rebuild_linked_connections() append_unique O(C*H^2) MEDIUM 97x
- vector_tpl::append_unique linear scan inside double loop over
goods categories x connections to collect unique connected halts
- fix: inthashtable_tpl for O(1) membership test
simutrans-0002: add_grund() registered_convoys.is_contained O(C*R) MEDIUM 45x
- iterates ALL world convoys, each with linear scan of registered
convoy vector to check membership
- fix: pre-build hash set of registered convoy IDs for O(1) lookup
simutrans-0003: rebuild_connections() consecutive_halts append_unique O(S^2) MEDIUM 24x
- append_unique on consecutive halt vectors per category inside
nested loop over schedules x entries during halt reconnection
- fix: parallel inthashtable_tpl for O(1) dedup
All three defects are in simhalt.cc halt reconnection paths, triggered
whenever schedules change (line added/removed, schedule edited, station
built). In large games with hundreds of halts and convoys, these
compound during reconnection sweeps.
MOAD-0002: welt (karte_t) is a god object but standard Simutrans architecture
MOAD-0003: CLEAN (no thread_local usage)
MOAD-0004: CLEAN (nettool password printf is by-design tool output)
MOAD-0005: CLEAN (save cache uses hashtable, no unsynchronized pattern)
bzflag-0001: bz_EventHandler::HasEvent() std::find on HandledEvents vector
called per-handler per-event-fire in callEvents hot path. O(E*H).
Fix: std::bitset<bz_eLastEvent>. HIGH, 8.4x speedup.
bzflag-0002: AccessControlList ban/hostBan/idBan std::find on growing
ban vector for dedup. O(B^2) during merge() of master ban list.
Fix: parallel unordered_set index. MEDIUM, 17x speedup.
bzflag-0003: parsePermissionString customPerms std::find dedup O(W*C).
Fix: std::set shadow for dedup. LOW-MEDIUM, 5.1x speedup.
MOAD-0004: bzfs.cxx:4732 logs auth token verbatim at debug level 1
(logDebugMessage with player token). Noted, not patched (debug only).
MOAD-0002 (intertangle): global mutable state typical for 1993 C++ game
server, not a clean god-object coupling defect.
MOAD-0003 (leaked context): no thread_local usage found. CLEAN.
MOAD-0005 (thundering herd): single-threaded server, no cache races. CLEAN.
naev-0001: map.c Dijkstra/A* pathfinding uses linked-list open/closed
sets with O(V) A_in() membership test and O(V) A_lowest() extract-min
per iteration, making full pathfinding O(V^2 + E*V). Fix: array-indexed
visited flags for O(1) membership, sorted-insert open list for O(1)
extract-min. 102.5x at V=500 (Naev has 538 star systems). HIGH.
naev-0002: tech.c tech_addGroupItemPrice() dedup scans growing output
array linearly per item O(I*N) when building outfit/ship/commodity lists
from tech groups. Fix: hash set for O(1) amortized dedup. 333x at
N=1000. MEDIUM.
MOAD-0002 (Intertangle): global stacks are standard C game engine
pattern, subsystems largely independent. CLEAN.
MOAD-0003 (Leaked Context): single thread_local in Rust RNG only. CLEAN.
MOAD-0004 (Logged Secret): no credentials in single-player game. CLEAN.
MOAD-0005 (Thundering Herd): single-threaded gameplay logic. CLEAN.
2/2 PASS, 2 defects.
236 source files scanned. Property tree uses O(N) find_child but only in
config-phase code. Runtime property access uses cached direct pointers.
Single-threaded codebase with small fixed-size collections throughout.
openxcom-0001: AIModule _reachable/_reachableWithAttack std::vector<int>
with std::find() inside AI loops (setupAmbush, setupEscape,
selectPointNearTarget, findFirePoint). O(N*R) per alien turn where
N = nodes checked, R = reachable tiles (~500 on typical map).
Fix: std::unordered_set<int> for O(1) lookup. MEDIUM-HIGH, 7.6x.
openxcom-0002: SavedGame::isResearched linear scan of _discovered vector
O(D) per call, called O(R*4) times from getAvailableResearchProjects
per base. Also unlocked vector with std::find O(R*U).
Fix: parallel unordered_set<string> for O(1) lookup. MEDIUM, 4.5x.
MOAD-0002 (Intertangle): CLEAN, typical game state architecture
MOAD-0003 (Leaked Context): CLEAN, single-threaded game
MOAD-0004 (Logged Secret): CLEAN, no credentials
MOAD-0005 (Thundering Herd): CLEAN, no concurrent caching
pioneer-0001: Sensors::Update m_radarContacts linear scan O(N*C) per frame
MEDIUM-HIGH, 250x at N=C=500. Hash set for O(1) membership check.
pioneer-0002: Faction::IsClaimed m_ownedsystemlist linear scan O(S*F*C)
MEDIUM, 219x at C=500. std::set for O(log C) lookup during sector gen.
pioneer-0003: SectorView::GetDisplayMode m_route std::find_if O(S*R) per frame
MEDIUM, 50x at S=5000 R=50. Hash set for O(1) route membership.
MOAD-0002 (Intertangle): Pi class is god object but architectural, not patchable.
MOAD-0003 (Leaked Context): CLEAN, thread_local used only for task graph internals.
MOAD-0004 (Logged Secret): CLEAN, no credentials in codebase (space sim).
MOAD-0005 (Thundering Herd): CLEAN, GalaxyCache uses map with proper locking.
3/3 unit tests PASS.
