java-topology/defects/numpy/numpy-diamond-recursion-CLEAN.md

Diamond Recursion Scan (numpy) — CLEAN (deeper scan)

Scan date: 2026-03-29 Pattern: Recursive cycle/dependency check without visited set (CWE-407 diamond recursion, O(2^D))

Files examined

• numpy/f2py/crackfortran.py:_get_depend_dict — uses deps dict as memoization cache; O(N²) list scan covered by numpy-0001 — CLEAN re diamond recursion
• numpy/linalg/lapack_lite/make_lite.py:resolveAllDependencies — iterative fixpoint with done_this set — CLEAN
• numpy/f2py/crackfortran.py:traverse — tree walker, not DAG — CLEAN

Verdict: CLEAN — no NEW diamond recursion CWE-407; numpy-0001 covers existing list-scan issue