# UNDF: UNDF-2026-000000187
# nmap — CWE-407 scan result: CLEAN (beyond nmap-0001)

**Scan date:** 2026-03-27
**Files scanned:**
- `scan_engine.cc` (probe management)
- `osscan2.cc` (OS fingerprint matching)
- `TargetGroup.cc` (target resolution)
- `FPEngine.cc` (fingerprint engine)

## Candidates Investigated

### HostOsScanStats::getActiveProbe() — osscan2.cc
Linear scan through `probesActive` (`std::list<OFProbe *>`). Called up to
6 times per received packet inside `processResp()`, which runs in a do-while
loop per scan round. However, `probesActive` is bounded by the total number
of OS detection probe types: NUM_SEQ_SAMPLES=6 + TUI probes ≤ ~20. This is
a constant-bounded list — O(20) = O(1) in practice. Not a qualifying CWE-407.

### UltraScanInfo::findHost() — scan_engine.cc
Uses `std::multiset::find()` with a comparator — O(log N), not O(N). Not a defect.

### TargetGroup DNS resolution — TargetGroup.cc
`std::find(nb_it, netblocks.end(), nb_old)` inside a loop over DNS requests.
The iterator `nb_it` advances monotonically (never resets to `begin()`),
making the total scan cost O(B) across all iterations — amortized O(1) per
request. Not a defect.

### osscan2.cc probe send loops
Multiple loops over `probesActive` (≤20 elements) and `FPtests` arrays
(NUM_FPTESTS=13). All bounded by compile-time constants. Not CWE-407.

## Verdict: CLEAN beyond nmap-0001
No new CWE-407 defects found in the scanned files.