# hurd-0003 — CWE-407: ports_interrupt_notified_rpcs — O(N) scan on every port death

**Severity:** MEDIUM
**File:** `libports/interrupt-notified-rpcs.c` lines ~31–46
**Function:** `ports_interrupt_notified_rpcs`
**CWE:** CWE-407 Algorithmic Complexity

## Defect

Walks full `_ports_notifications` linked list on every dead-name notification (every time a watched port dies). Inner loop over `np->reqs` cancels pending RPCs.

```c
for (np = _ports_notifications; np; np = np->next)    // O(N notifications)
  if (np->port == port && np->what == what)
    {
      struct rpc_notify *req;
      for (req = np->reqs; req; req = req->next_req)  // O(M requests)
        if (req->pending) { req->pending--; hurd_thread_cancel(...); }
      break;
    }
```

**Complexity:** O(N_notifications) per dead-name event. Port deaths cascade — one process crash fires many dead-name events simultaneously.

## Fix

Same root cause as hurd-0002: hash `_ports_notifications` by `(port, what)`. Both hurd-0002 and hurd-0003 are fixed by the same data structure change.