# UNDF: UNDF-2026-000000550
# tcpdump — CWE-407 scan result: CLEAN

**Scan date:** 2026-03-27
**Files scanned:**
- `print-ip.c` (IP packet printing)
- `addrtoname.c` (address to name cache)

## Candidates Investigated

### addrtoname.c — hash collision chains
`ipaddr_string()`, `ip6addr_string()`, `tcpport_string()`, `udpport_string()`,
`lookup_emem()` all traverse linked-list collision chains within a
HASHNAMESIZE=4096 bucket array.

Pattern:
```c
p = &hnametable[addr & (HASHNAMESIZE-1)];
for (; p->nxt; p = p->nxt) {
    if (p->addr == addr)
        return (p->name);
}
```

This is a standard open-chain hash table — O(1) average, O(B) worst case
per bucket where B = collision depth. The outer "loop" is the packet stream,
but each call is an independent hash lookup, not a membership test inside a
bounded outer loop. Bucket depth stays near O(1) with a good hash and
4096 buckets covering a 32-bit address space. This does not meet the
CWE-407 definition of "linear membership test inside a loop."

### print-ip.c — ip_optprint, ip_printroute, ip_printts
All loops are single-pass O(N) iterations over IP options or route entries.
No nested O(N) search inside a loop over options. Clean.

## Verdict: CLEAN
No CWE-407 defects found in the scanned files.