# CLEAN — Tor Anonymity Network (beyond tor-0001/0002/0003)
Scanned 2026-03-29 for additional CWE-407 defects beyond existing patches.

## Existing Defects (already patched)
- `tor-0001` — `router_load_routers_from_string` requested_fingerprints smartlist O(R²) → digestmap
- `tor-0002` — `nodes_have_common_family_id` family ID string scan → strmap
- `tor-0003` — KIST scheduler re-add heap index O(N) → O(1)

## Additional Areas Scanned
- `src/feature/client/entrynodes.c` — guard selection, sampled/confirmed guard lists
- `src/feature/nodelist/node_select.c` — node exclusion via bitarray (already O(N))
- `src/feature/hs/hs_service.c` — previous_hsdirs tracking (bounded ≤6 entries)
- `src/feature/relay/dns.c` — dns_wildcard_list scan (bounded ≤10 entries)
- `src/feature/client/circpathbias.c` — circuit list scan (one-off at circuit close)

## Findings
- **`nodelist_subtract`** — already uses `bitarray_t` for O(N) subtraction. CLEAN.
- **`entrynodes.c` guard BUG-checks** — constant-bounded (MAX_SAMPLE_THRESHOLD dozens). CLEAN.
- **`hs_service.c` previous_hsdirs** — bounded by `REND_NUMBER_OF_CONSECUTIVE_REPLICAS` (6). CLEAN.
- **`dns.c` wildcard list** — bounded to ~10 hijacked IPs. CLEAN.

**Result: No additional CWE-407 defects beyond existing patches.**