# netbsd-0003 — CWE-407: in_multicast_sysctl — O(I×A×G) double-pass traversal

**Severity:** LOW
**File:** `sys/netinet/in.c`
**Function:** `in_multicast_sysctl`
**CWE:** CWE-407 Algorithmic Complexity

## Defect

Triple nested loop (interfaces × addresses × multicast groups) traversed twice — once for buffer size estimation, once to copy data. Double-pass multiplies O(I×A×G) work by 2.

```c
/* pass 1: size estimation */
IFNET_FOREACH(ifp) {
    IFADDR_FOREACH(ifa, ifp) {
        LIST_FOREACH(inm, &..., inm_link) {
            needed += sizeof(*xim);   // count only
        }
    }
}

/* pass 2: copy */
IFNET_FOREACH(ifp) {
    IFADDR_FOREACH(ifa, ifp) {
        LIST_FOREACH(inm, &..., inm_link) {
            copyout(inm, p, ...);     // same traversal again
        }
    }
}
```

**Complexity:** 2 × O(I×A×G). For I=50 interfaces, A=10 addresses, G=20 groups: 10,000 iterations (effectively 20,000 with double-pass).

## Scale

Primarily impacts `sysctl(CTL_NET, PF_INET, IPPROTO_IP, IPCTL_MULTICAST_...)` callers (e.g., `netstat -gn`). On a multicast router the triple-loop cost is material.

## Fix

Single-pass with dynamic buffer growth (double-on-overflow strategy); eliminate re-traversal. Pay the realloc cost at most O(log(I×A×G)) times instead of doubling the traversal.