## Kodi 5-MOAD Scan — 2026-03-31

Target: https://github.com/xbmc/xbmc (depth=1)

### MOAD-0001 (CWE-407) — CLEAN
Kodi uses proper containers (maps, sets, unordered_map.contains()) throughout.
Only 11 files use std::find, all on small fixed-size collections:
- VAAPI/DXVA m_freeSurfaces std::find: bounded by decoder surface pool size
  (typically 16-32 surfaces), inside locked sections. Not O(N^2) at scale.
- MusicInfoScanner thumbs std::find: thumbs is a user-configured list of 3-10
  items. Bounded, not hot-path O(N^2).
- WSDiscovery IP dedup: O(N^2) but network discovery is bounded to ~100 devices max.
No significant MOAD-0001 defects found.

### MOAD-0002 (Intertangle) — ARCHITECTURAL NOTE (no patch)
CServiceBroker is a global service locator exposing 30+ subsystems (addons,
PVR, network, video, audio, filesystem, settings, peripherals, etc.). This is
a classic god-object / intertangle pattern. However, it is intentional Kodi
architecture providing DI-style access without singletons. Patching it would
require a multi-year architectural refactor. Documented as architectural debt.

### MOAD-0003 (Leaked Context) — ARCHITECTURAL NOTE (no patch)
xbmc/interfaces/legacy/LanguageHook.cpp uses `thread_local LanguageHook* addonLanguageHookTls`
to carry per-addon-invocation identity (addon ID, version, invoker ID) in our
scripting bridge. This is the MOAD-0003 pattern: request-scoped identity held
in thread-local storage. The LanguageHook.h comment (line 91) even acknowledges
the problem: "I need an InheritableThreadLocal C++ equivalent."
xbmc/interfaces/python/PyContext.cpp uses `thread_local PyContextState*` for
Python GIL management (not identity leakage per se — GIL state is inherently
per-thread).
The LanguageHook TLS is a true MOAD-0003 site but correcting it requires
replacing all addon callback dispatch with an explicit context parameter.
Documented as architectural debt.

### MOAD-0004 (CWE-312) — CLEAN
xbmc/platform/posix/filesystem/SMBFile.cpp redacts credentials in SMB log
messages using std::regex: `"(\\w+://)\\S+:\\S+@"` replaced with
`"$1USERNAME:PASSWORD@"`. No plaintext credential logging found elsewhere.
CLog searches across xbmc/network/, xbmc/filesystem/ return no password hits.

### MOAD-0005 (Thundering Herd) — CLEAN
CVideoThumbLoader::GetArtFromCache() has an unguarded get+insert pattern but
CBackgroundInfoLoader runs a single worker thread (std::unique_ptr<CThread>),
so concurrent access to m_artCache is impossible by design.
VAAPI/DXVA surface cache operations are all wrapped in std::unique_lock.
No concurrent cache stampede found.