xenia-0001: ObjectTable::GetAllObjects() in
src/xenia/kernel/util/object_table.cc uses std::find on a growing results
vector to deduplicate XObject pointers while iterating all 16,384+ table
slots. Each slot incurs an O(results.size()) linear scan, giving O(S*R)
total where S = slot count and R = unique object count. Fix: unordered_set
seen-pointer set reduces membership test to O(1). Measured 4.3x speedup.
MOAD-0002 Intertangle: CLEAN
MOAD-0003 Leaked Context: CLEAN (TLS vars are thread-scoped, not request-scoped)
MOAD-0004 CWE-312: CLEAN (no credentials or key bytes logged)
MOAD-0005 Thundering Herd: CLEAN (all caches use global_critical_region_ lock)
aranym-0001: hardware.cpp getModule() O(D) linear scan over 17 devices
on every 68k I/O read/write. Replaced with O(log D) binary search over
a sorted HWRange table built at HWInit(). 2.73x speedup measured.
ppsspp-0004: sceKernelLockMutex/CB and sceKernelLockLwMutex/CB (4 sites)
scan mutex->waitingThreads vector with std::find before push_back --
O(W) per lock attempt. Fix: parallel unordered_set for O(1) dedup.
Unit test extended to cover ppsspp-0004; all 8/8 PASS (ratios 5-27x).
retroarch-0002: core_info_database_supports_content_path O(C*(E+D)) per file
in ROM scanner, 193x speedup at C=100 cores; fix: ext->database hash map
built at core list init, O(1) lookups replace full core-list scan.
openemu-0001: SetupAssistant knownCores Array.contains O(N^2) core dedup,
17x op-count at N=35 cores; fix: Set<CoreDownload> for O(1) .contains.
MOADs 0002-0005 for both targets: RetroArch runloop is single-threaded by
design (no leaked context); no credential logging found (CHEEVOS_LOG_PASSWORD
guarded and undef'd by default); no unguarded cache thundering herd.
OpenEmu: no ThreadLocal patterns; no credential logging; NSCache is
thread-safe and duplicate fetch work is bounded.
openmsx-0001: MSXCPUInterface::checkBreakPoints() O(B) linear scan
over all breakpoints per Z80 instruction when any breakpoint is active.
Fix: unordered_map<uint16_t, vector<id>> index gives O(k) lookup where
k = breakpoints at current PC (typically 0). 500x improvement at B=500.
desmume-0001: armInnerLoop scans breakPoints std::vector<u32> linearly
O(B) on every ARM9 and ARM7 instruction (~66+33 MHz); replace with
std::unordered_set<u32> for O(1) lookup. 3.5x speedup at B=32. MOAD 0002-0005 CLEAN.
melonds-0001: GPU3D_Soft RenderScanline iterates all P polygons per
scanline O(P*S) per frame; active-list sweep gives O(P log P + A_total).
9x speedup at P=2048 with typical short-lived polygons. MOAD 0002-0005 CLEAN.
CWE-407: key dispatch uses 2-level array O(1), no list scan in hot paths;
breakpoints patched into JIT code (not per-instruction scan); controller
info heuristics O(N) only on hotplug event (not emulation loop). MOAD 0002:
current_system is expected single-emulator global. MOAD 0003: C codebase,
no ThreadLocal. MOAD 0004: megawifi stub strings are placeholders, not real
credential logging. MOAD 0005: no unsynchronized cache patterns found.
genesis-plus-gx-0001: retro_cheat_set duplicate cheat detection uses
O(N) linear scan over cheatlist[0..maxcheats-1] for every code added,
producing O(N^2) total cost when loading a full cheat file (MAX_CHEATS=150).
Fix: open-addressing hash table keyed by (address, data), O(1) per insert.
9x speedup measured at N=150.
dolphin-0001: BreakPoints::GetRegularBreakpoint O(N) std::ranges::find
over m_breakpoints vector, called per CPU instruction when breakpoints
are active. Fix: unordered_map<u32, size_t> index rebuilt on mutation,
O(1) lookup. 2.5x speedup at N=64, scales further with breakpoint count.
vice-0001: monitor breakpoint list O(N) scan per opcode — search_checkpoint_list
traverses sorted checkpoint linked list without early exit. Code comment promises
"we can drop out early" but never implements it. Fix: break when entry.start_addr
exceeds target address. 200x fewer comparisons for addresses below first breakpoint.
11/11 PASS.
DOSBox-X: dosbox-x-0001/0002 previously committed (2026-03-31). MOAD 0002-0005 CLEAN.
fbneo-0001: BurnDrvGetIndex O(N) linear scan over 24493 drivers -> O(1) unordered_map,
91x speedup at N=5000. Fix: hash index built at BurnLibInit, cleared at BurnLibExit.
mame: confirmed CLEAN on all 5 MOADs (binary search for driver lookup, single-threaded).
MOAD-0001 (CWE-407): Nestopia uses std::lower_bound (binary search, sorted
array) for cheat code lookup in NstCheats.cpp -- already O(log N). Input
mapping in fltkui/inputmanager.cpp uses hash maps (jbmap/jhmap/jamap keyed
by port*100+inum) -- O(1). No linear scan inside any hot loop found.
MOAD-0002: Subsystems communicate through typed API layers (Cpu::Link,
Cpu::Unlink, NES_PEEK_A/NES_POKE_AD macros). No shared god-object mutable
global state coupling found.
MOAD-0003: No ThreadLocal or thread-scoped identity carriers found.
Single-threaded emulation core.
MOAD-0004: No netplay or credential handling in core or fltkui. No logging
of secrets found.
MOAD-0005: No cache get+null+compute+put race patterns found. CLEAN.
MOAD-0001 (CWE-407): SubCheatsRead in src/cheat.cpp scans all C active
cheats linearly on every NES memory read at any cheat address. O(C) per
read, C up to 256. Fix: cheat_idx[0x10000] direct address lookup, O(1).
Unit test: 74.7x speedup at C=256. 1/1 PASS.
MOAD-0002: Global mutable state (SubCheats[], ARead[], CheatRPtrs[])
couples cheat, PPU, CPU subsystems -- expected single-threaded NES
architecture, not an actionable intertangle defect.
MOAD-0003: thread_local in profiler.cpp (per-thread profiling data) and
QtScriptManager.cpp (per-JS-engine context pointer) -- legitimate
thread-local scoping, not a leaked request context carrier.
MOAD-0004: NetPlay.cpp line 788 logs netplay session password verbatim
via printf("Authorize: Player: %i Passwd: %s\n", msg->playerId,
msg->pswd). Debug printf, no patch created per scan protocol (0001 only).
MOAD-0005: No cache get+null+compute+put races found. CLEAN.
https://github.com/sinamas/gambatte returns a placeholder README only:
"This project has been taken private." No source available to scan.
All 5 MOADs: UNSCANNED, source unavailable.
sameboy-0001: test_watchpoint() O(W) linear scan per GB memory read/write.
Every call to GB_read_memory / GB_write_memory scans all watchpoints when
n_watchpoints > 0. Fix: watchpoint_address_flags[0x10000] lookup table gives
O(1) early exit; 128x speedup at W=128.
sameboy-0002: should_break() O(B) linear scan per CPU instruction fetch.
GB_debugger_run() calls should_break() every instruction when debug_active.
Fix: breakpoint_address_set[0x10000] boolean table gives O(1) early exit;
128x speedup at B=128.
MOAD-0002: CLEAN, gb struct passed explicitly, no shared global state.
MOAD-0003: CLEAN, __thread only used for local string formatting buffers.
MOAD-0004: CLEAN, no network credentials logged.
MOAD-0005: CLEAN, no unsynchronized cache patterns found.
