wine: all 5 MOADs CLEAN (wine-0001 pre-existing); wireguard-go: all 5 MOADs CLEAN
Wine scan: hot paths use hash tables (module lookup), red-black trees (font
families, shader cache), binary search (registry), bounded lists (FBO<=64,
sampler<=16, MUI<=8). wine-0001 covers loader dependency dedup. No additional
CWE-407 defects. MOADs 0002-0005 CLEAN: loader_section is by design, no
request-scoped TLS leakage, kerberos logs only auth_data pointer (not value),
all caches protected by critical sections.
WireGuard-go scan: peers.keyMap is hash map O(1), AllowedIPs is radix trie O(32).
Private key and PSK are never logged (only "Updating X" labels). Device struct
has per-sub-struct sync.RWMutex with no thundering herd patterns. MOADs 0002-0005
CLEAN: well-decomposed Device struct, no goroutine-local leakage, proper sync.
russell@unturf.com
efe58242e0