MOAD-0001 (CWE-407): 2 defects found — see kronos-0001, kronos-0002

MOAD-0001 (CWE-407): DEFECT — kronos-0001
  - SH2HandleBreakpoints() in yabause/src/sys/sh2/include/sh2core.h:565
    scans codebreakpoint[0..numcodebreakpoints-1] linearly on EVERY
    instruction fetch in the debug interpreter (SH2KronosDebugInterpreterExec,
    SH2SimpleDebugInterpreterExec).  MAX_BREAKPOINTS=10, so worst-case 10
    comparisons per instruction.  At ~10 MIPS emulated that is 100M extra
    comparisons/second in debug sessions.
  - Fix: keep sorted_bp_addrs[] in sorted order; binary-search O(log N).
    Rebuild (insertion-sort, max 10 elements) only on add/del breakpoint.

MOAD-0002 (Intertangle): CLEAN
  - Saturn hardware is modeled as separate global structs (MSH2/SSH2, VDP1,
    VDP2, SCSP, SMPC, SCU).  These are intentional hardware-accuracy globals,
    not an accidental god-object coupling.  No independent subsystem is coupled
    through another's internals.

MOAD-0003 (Leaked Context): CLEAN
  - No thread_local or pthread_getspecific usage found in emulation core.
    The emulator is structured as a single main loop with the UI running in a
    separate Qt thread — context is passed explicitly, not via TLS.

MOAD-0004 (CWE-312): DEFECT — kronos-0002
  - yabause/src/utils/src/netlink.c:553
    NETLINK_LOG("password response: %s", NetlinkArea->inbuffer+start)
    When compiled with -DNETLINK_DEBUG (enabled for debug builds),
    NETLINK_LOG expands to DebugPrintf(MainLog, ...) and writes the
    Saturn modem internet-login password verbatim to the debug log.
    Also: login response (line 543) logs the username verbatim.
  - Fix: replace format string with a literal "[REDACTED]" sentinel.

MOAD-0005 (Thundering Herd): CLEAN
  - No cache get+null+compute+put pattern found outside of NETLINK_DEBUG
    debug paths.  YGL texture cache (yglcache.c) uses a hash table with
    no concurrent writers — single-threaded render thread.