kronos: 2 CWE-407/CWE-312 defects; mesen-s: all 5 MOADs CLEAN
kronos-0001 (CWE-407, MEDIUM): SH2HandleBreakpoints() in sh2core.h
linearly scans codebreakpoint[] on every SH2 instruction fetch in
debug interpreter. MAX_BREAKPOINTS=10, O(10) per fetch at 28.6 MHz
emulated = 286M extra comparisons/s. Fix: sorted_bp_addrs[] +
binary search, O(log N), 2.54x fewer comparisons measured.
kronos-0002 (CWE-312, LOW): netlink.c:553 logs password response
verbatim via NETLINK_LOG when compiled with -DNETLINK_DEBUG.
Fix: replace %s format with literal [REDACTED].
kronos MOAD-0002/0003/0005: CLEAN
mesen-s: all 5 MOADs CLEAN (CheatManager unordered_map O(1),
BreakpointManager guarded by _hasBreakpoint fast-path,
password hashed before network use, no TLS credential leakage)
8/8 tests PASS
russell@unturf.com
f30b6bdb52