# NetworkManager — 5-MOAD Scan — CLEAN

**Date:** 2026-03-31
**Repo:** https://github.com/NetworkManager/NetworkManager (depth=1)
**Scanned:** src/core/, src/core/devices/, src/core/dns/, src/core/supplicant/, src/core/vpn/

## MOAD-0001 (CWE-407) — CLEAN

No O(N^2) linear scan patterns in hot paths.

Patterns examined:

- `nm_utils_g_slist_find_str` in `nm-settings.c:update_specs()` — called on plugin config-change
  events (rare), not per-packet. P=plugins (2-3), S=specs (small). Not a hot path.
- `g_slist_find` in `nm-device-factory.c:nm_device_factory_manager_for_each_factory()` —
  factory init/dedup, runs once at startup.
- `nm_strv_ptrarray_contains` in `nm-l3-config-data.c` for nameserver/domain/search dedup —
  called per config-change on O(4) typical lists. Not a hot path.
- `nm_strv_find_first` in `nm-bond-manager.c` — already acknowledged as O(N^2) in a code
  comment; applies only to bond member reordering, not a per-packet hot path.
- DNS manager (`nm-dns-manager.c`) uses `g_hash_table` for domain dedup. Clean.
- Supplicant config (`nm-supplicant-config.c`) uses `g_hash_table` for option storage. Clean.

## MOAD-0002 (Intertangle) — CLEAN

`nm-manager.c` is large (9992 lines) but represents normal single-daemon architecture for
a Linux network manager. No pathological shared-mutable-global-state coupling detected across
independent subsystems that would qualify as an Intertangle defect.

## MOAD-0003 (Leaked Context) — CLEAN

Thread-local usage found:

- `_nm_utils_to_string_buffer` — formatting scratch buffer. Correct use.
- `_nm_utils_inet_ntop_buffer` — inet formatting buffer. Correct use.
- `_netns_stack` in `nmp-netns.c` — network namespace push/pop stack. Intentionally
  thread-local for safe per-thread namespace management. Not request-scoped identity leakage.
- `_tls_reg_key` in `nm-shared-utils.c` — TLS destructor registration. Infrastructure.

No request-scoped identity stored in thread-local context that outlives our request.

## MOAD-0004 (CWE-312) — CLEAN

All credential values are guarded with `"<hidden>"` display_value in
`nm_supplicant_config_add_option*()`:

- WEP keys: `"<hidden>"` at all call sites.
- WPA PSK (passphrase + hex): `"<hidden>"`.
- SAE password: `"<hidden>"`.
- LEAP password: `"<hidden>"`.
- EAP password: `"<hidden>"`.
- SIM PIN: `"<hidden>"`.
- Private key password: `"<hidden>"`.
- MKA CAK: `"<hidden>"`. MKA CKN logged as hex string (key name, not key material).

VPN secrets are passed via GVariant dicts and never logged verbatim.

## MOAD-0005 (Thundering Herd) — CLEAN

NetworkManager is single-threaded (GLib main loop). Only one mutex found
(`nmtst_host_id_lock`) in test infrastructure. No concurrent cache get+compute+put patterns.