russell@unturf.com
8d4d60b421
ollama-0001: kvcache/causal.go buildMask() Except []int linear scan O(B*E).
For Gemma3 multi-image prompts, slices.Contains(opts.Except, i) is called
per batch token. With N images x 256 tokens/image, B and |except| both scale
as N*256 giving quadratic prefill cost. Fix: convert Except to map[int]struct{}
before the outer loop. 3.4x speedup at N=10 images. Unit test PASS.
dosbox-staging scanned for all 5 MOADs; all CLEAN. Linear scans operate on
fixed small palettes (16 CGA colors), hardcoded 3-item lists, or single-call
config paths. Mixer mutex consistent. No credential logging.
Updated defects/ollama/CLEAN.md to note the missed defect from prior scan.
2.1 KiB
DOSBox-Staging — All 5 MOADs CLEAN
Date: 2026-03-31 Target: https://github.com/dosbox-staging/dosbox-staging (C++) Scanner: Agent Blackops 5-MOAD sweep Note: DOSBox-X (a different fork) has dosbox-x-0003 and dosbox-x-0004 defects. This is the maintained upstream staging fork.
MOAD-0001 (CWE-407): CLEAN
No O(N²) linear scan defects found. All membership checks operate on small fixed-size collections:
- vga_dac.cpp
is_cga_color/is_ega_color:std::findoncga16[16]andega[16]— fixed 16-element arrays, O(16) constant - messages.cpp
ImportantMessagesList:contains()on a hardcoded 3-element vector — constant - config.cpp
loaded_config_paths_canonical:contains()on config file paths — called once per file load, not hot - vga_dac.cpp outer loop:
for i in NumCgaColors(16)callsvga_dac_send_colorwhich callsis_cga_color— O(16*16) = 256 ops constant - support.h
contains()wrapper: used only for small enum-like checks throughout codebase
MOAD-0002 (Intertangle): CLEAN
No shared mutable god object coupling. DOSBox uses a section-based configuration system (Config::sections) with clean interfaces between subsystems. Each hardware subsystem (VGA, sound, CPU) has its own module with minimal shared state.
MOAD-0003 (Leaked Context): CLEAN
DOSBox-Staging is fundamentally single-threaded (main emulation loop). No thread-local or request-scoped identity leaks. The mixer uses a std::recursive_mutex correctly for the audio callback thread boundary.
MOAD-0004 (CWE-312): CLEAN
No credential logging found:
- softmodem.cpp: Logs connection host/port and modem ATDT command buffer — hostnames only, no passwords
- ethernet_slirp.cpp: Logs port forward rules — TCP/UDP ports only, no credentials
- No HTTP auth headers, API keys, or bearer tokens in codebase (DOSBox is a DOS emulator, not a network service)
MOAD-0005 (Thundering Herd): CLEAN
No concurrent cache races. Audio mixer uses std::recursive_mutex with std::lock_guard consistently. All hardware state is single-threaded. No map/cache get+null+put patterns.