Salt pcre/grain_pcre targeting passes user-controlled regex to re.match/re.compile
without timeout. Ansible inventory manager passes tilde-prefixed host patterns
directly to re.compile. Both fixed with ThreadPoolExecutor 1s timeout wrapper.
scan_verify.py: structural patch verification for all UNDF registry entries.
- Reads UNDF-REGISTRY.json, walks defects/*/patch/*.patch
- Checks: UNDF header comment, defective pattern in removed lines,
fix signature in added lines (HashSet/unordered_set/HashMap/etc.)
- Slug-to-patch filtering prevents cross-contamination in multi-entry dirs
- Additive patches (guard insertion) treated as WARN not FAIL
- Status: 454 PASS / 441 WARN / 12 FAIL / 300 NO_PATCH / 51 PENDING
- 74.2% structural coverage of clonable entries
check_coverage.py: CI gate — fails when new registry entries lack patch files.
- Any NO_PATCH entry (dir exists but no patch) causes exit code 1
- Designed to run on every commit to catch regressions early
- Quality (WARN/PASS) delegated to scan_verify.py
Makefile targets added:
make scan-verify — verbose structural verification (all 1258 entries)
make scan-verify-report — same + writes tests/SCAN-VERIFY-REPORT.md
make scan-verify-strict -- also fail on WARN
make coverage-check — CI gate for patch presence
Completes the three-tier coverage system:
unit/integration/functional Java tests (MOADs 0001-0011)
+ structural patch verification (1258+ UNDF indicators)
+ coverage CI gate (enforces no indicator left without a patch)
All 12 O(N²) algorithmic complexity defects confirmed in Redot Engine 26.2-alpha
(commit 360a8d3). Inherited verbatim from Godot Engine upstream. All patched.
Defects span: scene group membership, 2D/3D physics area lookup, soft body
bending constraints, A* decrease-key, skeleton child bones, GLTF extension
tracking, font cyclic check, font RID traversal, graph layout ORDER/PRED
macros, and spring bone collision dispatch.
Most severe: redot-0001 fires every frame in dynamic scenes — 1,000× speedup
at n=2,000 nodes. redot-0002/0003 fire 60Hz in physics-heavy games — 50×.
Strategy: patch Redot first, Godot follows our lead.
systemd-0004: seccomp_load_syscall_filter_set() in src/shared/seccomp-util.c uses
strv_contains(added, name) — O(|added|) linear scan — inside NULSTR_FOREACH over
~537 KNOWN syscalls. On x86_64 (3 arches): ~484,000 string comparisons per service
start with SeccompFilter=. Sibling function seccomp_load_syscall_filter_set_raw()
already uses hashmap_contains for O(1); this function was left behind.
Fix: build Set* from added strv before the NULSTR_FOREACH loop. MEDIUM severity.
dbus-0001: bus_client_policy_optimize() in bus/policy.c iterates R rules and for
each blanket deny/allow calls remove_rules_by_type_up_to() which scans backward
from current position to head — O(R^2) total per new connection creation.
At R=100 rules (realistic system bus): ~10,000 comparisons per connect.
Fix: single O(R) reverse pass tracking last-seen blanket per rule type. MEDIUM.
dbus 5-MOAD summary:
MOAD-0001: dbus-0001 DEFECT (policy optimize O(R^2))
MOAD-0002: CLEAN (BusContext is standard daemon context, not a god object)
MOAD-0003: CLEAN (single-threaded event loop, no thread-local state)
MOAD-0004: CLEAN (_dbus_verbose is no-op in production builds)
MOAD-0005: CLEAN (pending_activations hash table coalesces duplicate requests)
Rescan both targets against all 5 MOADs (2026-04-03).
New defect:
- transformers-0004: wav2vec2, wav2vec2_phoneme, esm tokenizers call
self.all_special_ids/@property inside per-token decode loops, rebuilding
list every iteration. O(T) -> O(1) fix: cache set before loop.
wav2vec2_phoneme also has type mismatch (str vs list[int]), making
the check always False, leaking special tokens.
9/9 unit tests PASS.
Existing defects confirmed still present (not re-filed):
- transformers-0001/0002/0003: unchanged from 2026-03-31 scan.
- vllm-0001/0002: unchanged from 2026-03-31 scan.
MOAD-0002/0003/0004/0005: CLEAN on both targets (see SCAN-2026-04-03.md).
SCAN-TODO.md: marked transformers and vllm as complete with full summary.
Also includes UNDF stamps on jicofo-0001, jicofo-0002, langchain-0002 patches
from prior generate_undf.py run.
Ollama: all 5 MOADs scanned. MOAD-0001 ollama-0001 (pre-existing). MOADs 0002/0003/0004/0005 CLEAN
per defects/ollama/CLEAN.md (scanned 2026-03-31).
LangChain: all 5 MOADs scanned. New defect langchain-0002 MOAD-0001 CWE-407.
- multi_query.py _unique_documents: `doc not in documents[:i]` creates O(D) slice each iteration
and performs O(D) linear scan, giving O(D^2) overall. D = Q*k where Q=queries, k=results per query.
- Fix: seen set with hashable proxy key (id, page_content, str(metadata items)). O(D) total.
- 9/9 unit tests PASS, 21.4x speedup at D=500.
MOADs 0002/0003/0004/0005 CLEAN per updated defects/langchain/CLEAN.md.
SCAN-TODO.md: mark both targets [x].
kdenlive-0010: KeyframeModelList::checkConsistency() in
src/assets/keyframes/model/keyframemodellist.cpp calls QList<GenTime>::contains()
inside nested loops — O(P*K^2) at clip load for multi-parameter keyframe effects.
Fix: std::set<GenTime> using operator< for O(log K) insert/lookup in both phases.
Speedup: 50x at K=100, 250x at K=500, 500x at K=1000 (P=3 params). 12/12 PASS.
Audacity: full 5-MOAD rescan on fresh clone confirms prior scan results.
No new defects. MOADs 0002/0003/0004/0005 CLEAN.
scribus-0004: scribus{150,170,171}format_save.cpp writes styles via
names.contains() on QList<QString> (from QMap::keys()) inside O(S) loop
— O(S²) per save. Fix: use lists.charStyles().contains() (QMap, O(log N))
directly. 6 defect sites across 3 format variants. 375x at N=1000.
darktable: 5-MOAD scan complete (darktable-0001..0005 + MOAD-0002/0003/0005
CLEAN already committed). No new defects found beyond prior scan.
SCAN-TODO: mark both targets as scanned with summary.
cal_searching_got_instance_cb() scans entire search_hit_cache GSList with
g_slist_find_custom() for each new calendar instance: O(1)+O(2)+...+O(N)
= O(N^2). Fix: parallel GHashTable for O(1) membership test. 433x op-count
speedup at N=1000. MOADs 0002/0003/0004/0005 CLEAN.
cura-0002: SettingInheritanceManager._settings_with_inheritance_warning is a List[str].
Queried with `in` and mutated with .append()/.remove() on every setting property change.
With S=1000 settings, each _onPropertyChanged call costs O(S). Fix: Set[str] for O(1)
membership. 109x speedup at S=1000.
prusaslicer-0004: chain_monotonic_regions() in FillRectilinear.cpp uses std::find to
search a work queue of MonotonicRegion* on every dequeue. Queue grows to O(R) regions;
10 ants each dequeue all R regions → O(10*R^2) total. Fix: std::vector<bool> in_queue
indexed by region offset for O(1) membership. 64x speedup at R=500.
prusaslicer-scan: MOADs 0002/0003/0004/0005 CLEAN (thread_local is RNG only; no
request-scoped leakage; no full credential logging; slicing is single-threaded).
Restructure openscad-0001 (was in wrong dir, Java test) into proper
openscad-0001/ with TICKET.md and Python test. New openscad-0002 patches
PolySetBuilder::endPolygon + appendPolySet std::find on colors_ vector ->
unordered_map; Color4f already has std::hash. New openscad-0003 patches
OctoPrint::requestApiKey and getJsonData to stop logging API responses
verbatim (app_token + api responses exposed under --debug).
MOADs 0002/0003/0005 CLEAN.
