MOAD-0001: citra-0001 RasterizerCache page_table surfaces vector O(P*S^2)
UnregisterSurface calls std::find(surfaces.begin(), surfaces.end(), surface_id)
for each of P pages a surface spans. With S overlapping surfaces per page,
total unregister cost is O(P*S) per surface, O(P*S^2) overall.
Fix: change std::vector<SurfaceId> to std::unordered_set<SurfaceId>
(std::hash<Common::SlotId> already defined). 3.4x measured at S=500, P=64.
Hot path: InvalidateRegion called per CPU write to GPU texture memory.
MOAD-0002: CLEAN. System singleton is intentional single-emulator architecture;
subsystems injected via System& reference, no intertangle coupling found.
MOAD-0003: CLEAN. thread_local only used for JNIEnv* JVM attachment in Android
JNI (standard pattern, not request-scoped identity).
MOAD-0004: CLEAN. No credential values logged verbatim; JWT token size only.
MOAD-0005: CLEAN. GetPublicKey static cache is room-server single-threaded;
JitEngine shader cache is GPU-thread single-threaded; all others use mutex.
Source: azahar-emu/azahar (Citra continuation), depth=1.
gearboy-0001: Processor::CheckBreakpoints() and CheckMemoryBreakpoints() scan
m_breakpoints std::vector O(B) on every opcode dispatch and every memory
Read/Write. At ~4 MHz with B=64 breakpoints: ~256M comparisons/second.
Fix: std::unordered_set<u16> index for O(1) point-breakpoint lookup.
8.4x speedup measured in Java model.
gearsystem-0001: Same defect in GearSystem (SMS/GG emulator). Compounded by
Video.cpp calling CheckMemoryBreakpoints() on every VDP VRAM/CRAM access
(5 additional call sites beyond CPU). >5M O(B) scans/second at 3.58 MHz.
7.1x speedup measured in Java model.
minivmac: All 5 MOADs CLEAN. LocalFindATTel() bounded to 16-20 ATT entries
by design (constant, not O(N^2)). Single-threaded, no credentials, no TLS.
MOAD-0001 squid-0002: HttpHeader::removeConnectionHeaderEntries() O(H*C) per response hop.
strListIsMember() scans all C Connection tokens for each of H header entries. Fix: pre-build
unordered_set from Connection tokens once, probe O(1) per entry. 4.84x measured speedup at
H=200 headers / C=50 Connection tokens. Called per hop in removeHopByHopEntries().
MOAD-0004 squid-0003: CWE-312 credentials logged verbatim in debug output.
FtpGateway.cc loginParser() logs user:password at debug 9; basic/Config.cc decodeCleartext()
logs decoded cleartext at debug 9 AND logs full Authorization header at DBG_IMPORTANT (level 1,
always on); basic/UserRequest.cc startHelperLookup() logs user:password at debug 9.
Fix: replace credential values with redacted markers / length-only diagnostic info.
MOAD-0002: SquidConfig 571-line god object in 209 files, 1408 call sites — structural,
documented in defects/squid/scan/MOAD-RESULTS.md.
MOAD-0003: CLEAN (event-loop single-threaded, no thread_local for request context).
MOAD-0005: CLEAN (event-loop single-threaded, no concurrent cache race).
play-0001: CIopBios::FindIntrHandler() O(H) linear scan per IOP interrupt.
Called from HandleInterrupt() thousands of times per second. Fix: direct
index array m_intrHandlerIndex[LINES_MAX] keyed by interrupt line -> O(1).
Algorithmic ratio 32x (H=MAX_INTRHANDLER=32), timing 5.6x. 5/5 PASS.
Basilisk II: all 5 MOADs CLEAN. Video/newcpu lookuptab searches are cold
paths only; no god object, thread_local identity, credential logging, or
unsynchronized cache patterns found.
xenia-0001: ObjectTable::GetAllObjects() in
src/xenia/kernel/util/object_table.cc uses std::find on a growing results
vector to deduplicate XObject pointers while iterating all 16,384+ table
slots. Each slot incurs an O(results.size()) linear scan, giving O(S*R)
total where S = slot count and R = unique object count. Fix: unordered_set
seen-pointer set reduces membership test to O(1). Measured 4.3x speedup.
MOAD-0002 Intertangle: CLEAN
MOAD-0003 Leaked Context: CLEAN (TLS vars are thread-scoped, not request-scoped)
MOAD-0004 CWE-312: CLEAN (no credentials or key bytes logged)
MOAD-0005 Thundering Herd: CLEAN (all caches use global_critical_region_ lock)
aranym-0001: hardware.cpp getModule() O(D) linear scan over 17 devices
on every 68k I/O read/write. Replaced with O(log D) binary search over
a sorted HWRange table built at HWInit(). 2.73x speedup measured.
ppsspp-0004: sceKernelLockMutex/CB and sceKernelLockLwMutex/CB (4 sites)
scan mutex->waitingThreads vector with std::find before push_back --
O(W) per lock attempt. Fix: parallel unordered_set for O(1) dedup.
Unit test extended to cover ppsspp-0004; all 8/8 PASS (ratios 5-27x).
retroarch-0002: core_info_database_supports_content_path O(C*(E+D)) per file
in ROM scanner, 193x speedup at C=100 cores; fix: ext->database hash map
built at core list init, O(1) lookups replace full core-list scan.
openemu-0001: SetupAssistant knownCores Array.contains O(N^2) core dedup,
17x op-count at N=35 cores; fix: Set<CoreDownload> for O(1) .contains.
MOADs 0002-0005 for both targets: RetroArch runloop is single-threaded by
design (no leaked context); no credential logging found (CHEEVOS_LOG_PASSWORD
guarded and undef'd by default); no unguarded cache thundering herd.
OpenEmu: no ThreadLocal patterns; no credential logging; NSCache is
thread-safe and duplicate fetch work is bounded.
openmsx-0001: MSXCPUInterface::checkBreakPoints() O(B) linear scan
over all breakpoints per Z80 instruction when any breakpoint is active.
Fix: unordered_map<uint16_t, vector<id>> index gives O(k) lookup where
k = breakpoints at current PC (typically 0). 500x improvement at B=500.
desmume-0001: armInnerLoop scans breakPoints std::vector<u32> linearly
O(B) on every ARM9 and ARM7 instruction (~66+33 MHz); replace with
std::unordered_set<u32> for O(1) lookup. 3.5x speedup at B=32. MOAD 0002-0005 CLEAN.
melonds-0001: GPU3D_Soft RenderScanline iterates all P polygons per
scanline O(P*S) per frame; active-list sweep gives O(P log P + A_total).
9x speedup at P=2048 with typical short-lived polygons. MOAD 0002-0005 CLEAN.
genesis-plus-gx-0001: retro_cheat_set duplicate cheat detection uses
O(N) linear scan over cheatlist[0..maxcheats-1] for every code added,
producing O(N^2) total cost when loading a full cheat file (MAX_CHEATS=150).
Fix: open-addressing hash table keyed by (address, data), O(1) per insert.
9x speedup measured at N=150.
dolphin-0001: BreakPoints::GetRegularBreakpoint O(N) std::ranges::find
over m_breakpoints vector, called per CPU instruction when breakpoints
are active. Fix: unordered_map<u32, size_t> index rebuilt on mutation,
O(1) lookup. 2.5x speedup at N=64, scales further with breakpoint count.
vice-0001: monitor breakpoint list O(N) scan per opcode — search_checkpoint_list
traverses sorted checkpoint linked list without early exit. Code comment promises
"we can drop out early" but never implements it. Fix: break when entry.start_addr
exceeds target address. 200x fewer comparisons for addresses below first breakpoint.
11/11 PASS.
DOSBox-X: dosbox-x-0001/0002 previously committed (2026-03-31). MOAD 0002-0005 CLEAN.
fbneo-0001: BurnDrvGetIndex O(N) linear scan over 24493 drivers -> O(1) unordered_map,
91x speedup at N=5000. Fix: hash index built at BurnLibInit, cleared at BurnLibExit.
mame: confirmed CLEAN on all 5 MOADs (binary search for driver lookup, single-threaded).
MOAD-0001 (CWE-407): SubCheatsRead in src/cheat.cpp scans all C active
cheats linearly on every NES memory read at any cheat address. O(C) per
read, C up to 256. Fix: cheat_idx[0x10000] direct address lookup, O(1).
Unit test: 74.7x speedup at C=256. 1/1 PASS.
MOAD-0002: Global mutable state (SubCheats[], ARead[], CheatRPtrs[])
couples cheat, PPU, CPU subsystems -- expected single-threaded NES
architecture, not an actionable intertangle defect.
MOAD-0003: thread_local in profiler.cpp (per-thread profiling data) and
QtScriptManager.cpp (per-JS-engine context pointer) -- legitimate
thread-local scoping, not a leaked request context carrier.
MOAD-0004: NetPlay.cpp line 788 logs netplay session password verbatim
via printf("Authorize: Player: %i Passwd: %s\n", msg->playerId,
msg->pswd). Debug printf, no patch created per scan protocol (0001 only).
MOAD-0005: No cache get+null+compute+put races found. CLEAN.
sameboy-0001: test_watchpoint() O(W) linear scan per GB memory read/write.
Every call to GB_read_memory / GB_write_memory scans all watchpoints when
n_watchpoints > 0. Fix: watchpoint_address_flags[0x10000] lookup table gives
O(1) early exit; 128x speedup at W=128.
sameboy-0002: should_break() O(B) linear scan per CPU instruction fetch.
GB_debugger_run() calls should_break() every instruction when debug_active.
Fix: breakpoint_address_set[0x10000] boolean table gives O(1) early exit;
128x speedup at B=128.
MOAD-0002: CLEAN, gb struct passed explicitly, no shared global state.
MOAD-0003: CLEAN, __thread only used for local string formatting buffers.
MOAD-0004: CLEAN, no network credentials logged.
MOAD-0005: CLEAN, no unsynchronized cache patterns found.
samba-0001: security_token_has_sid O(A*S) in se_access_check
- security_token_has_sid() does O(S) linear scan over token SIDs
- called inside O(A) ACE loop in se_access_check_implicit_owner()
- O(A*S) per file access; S=200 groups, A=20 ACEs = 4000 comparisons
- fix: sort token->sids[2..] at finalization, use bsearch for O(log S)
- 9.5x measured speedup (S=200, A=20); up to 26x at S=200, A=50
- hot path: called on every smbd file open / access check
samba-0002: security_token_create O(N^2) SID dedup (source4 AD DC path)
- nested for-loop in security_token_create deduplicates SIDs O(N^2)
- Kerberos PAC with 500 group SIDs: ~125,000 dom_sid_equal() calls/login
- at MS-KILE 1015-SID limit: ~515,000 calls per DC login
- fix: binary insertion sort scratch array for O(N log N) dedup
- 5.7x speedup at N=500, 9.3x at N=1000 (near PAC limit)
- also applies security_token_sort_sids() after token build
MOAD-0002: smbd is single-threaded event loop, global state is by design
MOAD-0003: no thread-local credential storage found
MOAD-0004: all sensitive dumps guarded by #ifdef DEBUG_PASSWORD compile flag
MOAD-0005: all caches TDB-synchronized or single-threaded event loop
MOAD-0001 (CWE-407): filterMetrics() in allocate.go calls containsPeer()
(linear scan) three times per metric in our inner loop — once for blacklist,
once for currentAllocs, once for priorityList. With M metrics and B+C+P
total peer-list entries, each allocation decision costs O(M*(B+C+P)).
Fix: Build map[peer.ID]struct{} sets before our loop. Each lookup becomes O(1).
At scale (200 peers, 100-entry lists): ~60x fewer comparisons.
MOAD-0002 (intertangle): allocation state passed as function args, no globals. CLEAN.
MOAD-0003 (leaked context): no ThreadLocal or goroutine-scoped carriers. CLEAN.
MOAD-0004 (logged secret): peer IDs logged, no auth tokens or private keys. CLEAN.
MOAD-0005 (thundering herd): allocation runs under consensus lock. CLEAN.
lotus-0001: eventFilter.matchAddress() slices.Contains O(A) per event,
replace with map[address.Address]struct{} for O(1) lookup; 28.6x at A=100,
225x at A=1000; no limit enforced on Addresses in EthFilterSpec
nfs-utils-0001: client_lookup() non-FQDN branch O(N) linked list
scan per call in support/export/client.c:289. With N unique
wildcard/netgroup/subnet clients, export_read totals O(N^2).
Fix: hash table for hostname lookup. 119x at N=4000.
nfs-utils-0002: get_exportlist() in utils/mountd/mountd.c,
lookup_or_create_elist_entry O(E) path scan + insert_group
O(G) dedup scan, both per export = O(E^2) total. Fix: hash
tables for path lookup and group dedup. 73x at N=4000.
MOAD-0002 (intertangle): clientlist/exportlist globals are standard
single-threaded daemon design, single execution context. CLEAN.
MOAD-0003 (leaked context): no __thread or pthread_getspecific. CLEAN.
MOAD-0004 (logged secret): gssd logs keytab paths and principal
names (not credentials). No key material logged. CLEAN.
MOAD-0005 (thundering herd): caches protected by ple_lock mutex
in gssd, single-threaded event loop in mountd. CLEAN.
