# UNDF: UNDF-2026-000000081
# go-stdlib deeper scan — CLEAN

**Scan date:** 2026-03-27
**Files scanned:**
- `src/net/http/header.go`
- `src/net/http/transport.go`
- `src/go/types/check.go`
- `src/cmd/link/internal/ld/deadcode.go`

## Findings

### `src/net/http/header.go` — CLEAN
`hasToken` contains a single linear substring scan but is not called inside
an outer loop. No O(n²) membership test pattern.

### `src/net/http/transport.go` — CLEAN (assertion only)
`tryPutIdleConn` has a for-range dup check over `idles`:
```go
for _, exist := range idles {
    if exist == pconn { log.Fatalf(...) }
}
```
This is a debug assertion guarding against internal invariant violation
(`log.Fatalf` terminates the process). It is not a hot path — called once per
completed HTTP request, not inside an outer loop over connections. The `idles`
slice is also bounded by `MaxIdleConnsPerHost` (default 100), and the inner
guard is O(100) per request event. Below CWE-407 threshold.

### `src/go/types/check.go` — CLEAN
No linear slice membership tests inside loops. The type-checker uses maps for
all deduplication. The existing `go-0001` patch already covers
`tpWalker.isParameterized` in `src/cmd/compile/internal/types2/infer.go`.

### `src/cmd/link/internal/ld/deadcode.go` — CLEAN
`d.ifaceMethod[m.m]` and `d.genericIfaceMethod[m.m.name]` are map lookups O(1).
The outer work-queue loop in `flood()` does not contain any linear slice
membership tests; all set membership uses Go maps.

## Conclusion
No new CWE-407 defects found in these four files beyond the previously patched
`go-stdlib-0001` (http2/rfc9218Priority) and `go-0001` (types2/tpWalker).