- netty-0001: DnsResolveContext.finalResult ArrayList.contains O(R²) dedup on DNS records
File: resolver-dns/.../dns/DnsResolveContext.java line ~914
Fix: LinkedHashSet gives O(1) dedup with preserved insertion order
Ratio: 24.5x at R=50 records
- dubbo-0002: MethodWalker.walkHierarchy no visited guard — O(2^D) diamond recursion
File: dubbo-rpc-triple/.../rest/util/MethodWalker.java walkHierarchy()
Fix: add visited HashSet, return early if already visited
Ratio: 8x at D=3 (common Spring proxy depth)
- doris-0004: NormalizeRepeat.buildContextWithAlias ImmutableList.contains O(S×G) for GROUPING SETS
File: fe-core/.../nereids/rules/analysis/NormalizeRepeat.java buildContextWithAlias()
Fix: convert groupingSetExpressions to HashSet before loop — O(1) lookup
Ratio: 49x for CUBE(c1..c8), 1000x+ for CUBE(c1..c10)
Scanned bitcoin/dragonfly/tor/transmission/nmap/ceph/allegro5 for additional
CWE-407 defects. All repos found CLEAN beyond previously recorded patches.
Updated tor/CLEAN.md to correctly reference existing tor-0001 through tor-0003.