# UNDF: UNDF-2026-000000901
--- a/Core/HLE/sceKernelThread.cpp
+++ b/Core/HLE/sceKernelThread.cpp
@@ -2544 +2544 @@
-			if (std::find(t->waitingThreads.begin(), t->waitingThreads.end(), currentThread) == t->waitingThreads.end())
+			if (t->waitingThreadSet.insert(currentThread).second)
 				t->waitingThreads.push_back(currentThread);
@@ -2571 +2571 @@
-			if (std::find(t->waitingThreads.begin(), t->waitingThreads.end(), currentThread) == t->waitingThreads.end())
+			if (t->waitingThreadSet.insert(currentThread).second)
 				t->waitingThreads.push_back(currentThread);
#
# CWE-407: sceKernelWaitThreadEnd and sceKernelWaitThreadEndCB scan
# t->waitingThreads vector with std::find before push_back — O(W) per
# wait where W = number of waiting threads. In pathological cases where
# many threads wait on the same target (e.g., barrier-like patterns in
# homebrew), this degrades to O(W^2).
# Fix: maintain parallel unordered_set for O(1) dedup.
# Severity: MEDIUM — kernel thread wait is a hot HLE path; homebrew
# using thread synchronization patterns can trigger this.