# analyzer baseline -- maintained by staticGate.sh (see its header)
# format: <count> <normalized key>, each preceded by its justification:
#   # FP: <reason>          triaged false positive
#   # THIRDPARTY: <reason>  upstream code, not modified by DVX
#   # UNTRIAGED ...         accepted by --update, not reviewed yet
# staticGate.sh --update keeps these comments with their keys, drops
# keys whose count is now 0, and marks new or grown keys UNTRIAGED.

# FP: the strdup'd value is stored via arrput in c->values (freed with the choices); the stb_ds OOM hook never returns, so arrput cannot fail and drop it.
1 src/apps/kpunch/cpanel/cpSounds.c|choiceAdd|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: the strdup'd label is stored via arrput in c->owned (freed with the choices), or freed at once; the stb_ds OOM hook never returns, so arrput cannot drop it.
1 src/apps/kpunch/cpanel/cpSounds.c|choiceSetLabel|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: the malloc is stored in the module being built (mod->classes / mod->withEvents entries or an interface map), which basModuleFree releases on success and on every failure path; the analyzer loses the store into the caller-owned module.
3 src/apps/kpunch/dvxbasic/compiler/compiler.c|buildWithEvents|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: the malloc is stored in sw->full (sw is rt->screenWin, heap), freed by screenModeChanged and basFormRtScreenClose; analyzer loses the store into the caller's heap struct.
2 src/apps/kpunch/dvxbasic/formrt/formGfx.c|screenFullFrame|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: the malloc'd text becomes newGeneral, which stashEditor stores in sGeneralBuf (freed with the next edit or the project); every failure path frees it.
1 src/apps/kpunch/dvxbasic/ide/ideMain.c|generalAppend|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: strdup result is stored via arrput in the static sLabelBufs array, freed on the next rebuild and in the dialog teardown.
1 src/apps/kpunch/dvxbasic/ide/ideMenuEditor.c|rebuildList|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: both strdups are stored via arrput in the static sCellData array, released by freeCellData.
1 src/apps/kpunch/dvxbasic/ide/ideProperties.c|addPropRow|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: stb_ds arrlen macro NULL-tests seeds after arrput already wrote through it; arrput cannot leave it NULL since the stb_ds OOM hook never returns.
1 src/apps/kpunch/dvxbasic/runtime/gfx.c|floodFill|check of <x> for NULL after already dereferencing it [-Wanalyzer-deref-before-check]
# FP: path needs realloc to both succeed and return NULL; on real failure the old buffer stays in b->buf and the caller frees it.
1 src/apps/kpunch/dvxbasic/runtime/serialize.c|bufGrow|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: values filled by variadic popArgs (writes through va_arg pointers the analyzer does not follow; FOR_INIT step/limit, RGB, STRING$ added more sites); was the basVmStep key before the basVmStepExec split.
7 src/apps/kpunch/dvxbasic/runtime/vm.c|basVmStepExec|use of uninitialized value <x> [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
# FP: MID$ assignment operands are filled by variadic popArgs (writes through va_arg pointers the analyzer does not follow); underflow returns before any use.
4 src/apps/kpunch/dvxbasic/runtime/vm.c|execStringOp|use of uninitialized value <x> [CWE-457] [-Wanalyzer-use-of-uninitialized-value]
# FP: copy is stored via arrins at m->history[0] (trimmed by the pop loop, freed with the model); stb_ds grow aborts rather than failing.
1 src/libs/kpunch/dvxshell/pmModel.c|pmHistoryAdd|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: allocSlot (inlined) stores the calloc'd ShellAppT via arrput in sApps (slots live as long as the shell and are reused); the stb_ds OOM hook never returns, so arrput cannot drop it.
1 src/libs/kpunch/dvxshell/shellApp.c|shellLoadAppInternal|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: dialogCreate stores &state->base (the first member) as the window's userData; dvxDialogRun frees it, and every caller (fnShowLicence included) runs the dialog it creates.
1 src/libs/kpunch/libdvx/dvxDialog.c|dvxDialogCreate|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: name copy is stored in fd->entries[] and freed by the listing free loop.
1 src/libs/kpunch/libdvx/dvxDialog.c|fdAddEntry|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: fdAddEntry stores the grown realloc block in fd->entries before returning; the listing is freed by the dialog free loop.
1 src/libs/kpunch/libdvx/dvxDialog.c|fdLoadDir|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: copy replaces e->value (entry in h->entries, freed by prefsClose / freeEntry); new-key strings go into h->entries via arrins.
2 src/libs/kpunch/libdvx/dvxPrefs.c|prefsSetString|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: idleTrim: oldest is set on every idle entry counted, and its callers pass keep >= 0 (FONT_IDLE_MAX or 0), so idle > keep means at least one idle entry and oldest is not NULL.
1 src/libs/kpunch/libdvx/dvxText.c|idleTrim|dereference of NULL <x> [CWE-476] [-Wanalyzer-null-dereference]
# FP: scanFonts stores sourceMake's allocation in face->src, an element of the global sFamilies stb_ds array (faceFree releases it); the analyzer loses the pointer in the array.  Unchanged loop; the path set moved when the font list came from platformKindReadDir (never NULL).
1 src/libs/kpunch/libdvx/dvxText.c|scanFonts.part.0|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: name is stored via arrput into the returned array (freed by dvxReadDirFree); was the stb_ds.h|dvxReadDir key.
3 src/libs/kpunch/libdvx/platform/dvxPlatformUtil.c|dvxReadDir|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: each name (dvxReadDir's, or a strdup'd VENDOR\NAME) moves into the returned list by arrput, which platformKindReadDir hands on or frees; the stb_ds OOM hook never returns.
3 src/libs/kpunch/libdvx/platform/dvxPlatformUtil.c|kindList|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: same arrput store as ideProperties.c|addPropRow, reported at the stb_ds macro expansion.
1 src/libs/kpunch/libdvx/thirdparty/stb_ds.h|addPropRow|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: fillRows' row (its fields) is stored via arrput in d->rows, freed by freeCache; reported at the stb_ds macro expansion.
1 src/libs/kpunch/libdvx/thirdparty/stb_ds.h|fillRows|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: each match's strdup is stored via arrput into *walk->files (collectGlobFiles' list, freed by the caller); reported at the stb_ds macro expansion.
2 src/libs/kpunch/libdvx/thirdparty/stb_ds.h|globVisit.part.0|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: li->count > idx guarantees widgetAdoptOwnedStrings copies count > 0 entries; the path needs its loop to run 0 times.  Reached directly and via listPopupRemoveItem; the analyzer reports the path once or twice from run to run.
2 src/libs/kpunch/libdvx/thirdparty/stb_ds.h|listItemsRemove|dereference of NULL <x> [CWE-476] [-Wanalyzer-null-dereference]
# FP: strdup("") is stored via arrput in remapped, which becomes lv->ownedCells (freed with the widget).
1 src/libs/kpunch/libdvx/thirdparty/stb_ds.h|listViewRemapOwnedCells|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: row stored into d->rows via arrput; freeCache releases it (the real partial-load leak was fixed: freeCache walks arrlen).
1 src/libs/kpunch/libdvx/thirdparty/stb_ds.h|loadCache|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: copy/m.path are stored in sMemFiles via arrput and held on purpose until DVX exits (read-only media keeps settings in memory); stb_ds OOM hook never returns.
2 src/libs/kpunch/libdvx/thirdparty/stb_ds.h|memFileStore|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: each module record is appended to *walk->mods via arrput (the loader's list for the whole run, freeMods); the analyzer loses the store into the caller's array.
1 src/libs/kpunch/libdvx/thirdparty/stb_ds.h|moduleVisit.part.0|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: each folder entry's strdup'd name is stored via arrput in names and freed by platformWalkDir's last loop; reported at the stb_ds macro expansion.
3 src/libs/kpunch/libdvx/thirdparty/stb_ds.h|platformWalkDir|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: inlined memFileStore - same arrput store into sMemFiles, held until DVX exits; stb_ds OOM hook never returns.
2 src/libs/kpunch/libdvx/thirdparty/stb_ds.h|prefsSaveAs.part.0|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: each procBuf is stored via arrput into *outProcs (freed by the caller, and by splitProcs itself on its failure path); reported at the stb_ds macro expansion.
1 src/libs/kpunch/libdvx/thirdparty/stb_ds.h|splitProcs|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# THIRDPARTY: upstream stb_image_write's stretchy buffers (stbiw__sbpush) keep each block as (int *)p + 2, which the analyzer loses; seen now that it is compiled static in dvxImage.c (B1). Upstream code not modified.
5 src/libs/kpunch/libdvx/thirdparty/stb_image_write.h|stbi_zlib_compress|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# THIRDPARTY: upstream stbiw__zlib_flushf, the same stretchy-buffer pointer (stbiw__sbpush). Upstream code not modified.
2 src/libs/kpunch/libdvx/thirdparty/stb_image_write.h|stbiw__zlib_flushf|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: the stack block is stored in task->stack (tasks[] entry, freed by tsKill/tsExit/tsShutdown); the analyzer loses it at the dummy-return-address store into the block.
1 src/libs/kpunch/libtasks/taskswitch.c|tsCreate|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: really listItemsAdd (inlined listItemsSync context): the strdup is stored via arrput in li->owned, freed by listItemsFree/Remove/Clear.
1 src/libs/kpunch/listhelp/listHelp.c|listItemsRemove|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: each strdup is stored via arrput in copy, which is returned to the caller as its owned array.
1 src/libs/kpunch/listhelp/listHelp.c|widgetAdoptOwnedStrings|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: data stored in topic->records[] and freed by freeAll; count 2 because the loader also compiles dvxhlpc.c.
2 src/tools/dvxhlpc.c|addRecord|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: postings buffer is stored in the trigrams[] entry (tri->postings) and freed by freeAll; the analyzer loses the store through the pointer into the realloc'd array. Count 2: host tool and loader builds both compile dvxhlpc.c.
2 src/tools/dvxhlpc.c|addTrigram|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: data is stored in cd->pixelData on the line after free(cd->pixelData); freed with the widget.
1 src/widgets/kpunch/canvas/widgetCanvas.c|wgtCanvasResize|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: copy replaces fields[i] (a row of d->rows, freed by freeCache); the origFields failure path frees it.
1 src/widgets/kpunch/dataCtrl/widgetDataCtrl.c|dataCtrlSetField|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: on a failed strdup freeFields(fields, i) frees entries 0..i-1 and the array; nothing leaks.
1 src/widgets/kpunch/dataCtrl/widgetDataCtrl.c|dupFields|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: each field copy goes into row.fields, which arrput stores in d->rows (freed by freeCache); a failed copy frees the row's fields first.  Reported at the loop and at the stb_ds macro.
1 src/widgets/kpunch/dataCtrl/widgetDataCtrl.c|fillRows|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: strings stored in row.fields / d->colNames via arrput, released by freeCache (which now walks arrlen, fixing the real partial-load leak).
2 src/widgets/kpunch/dataCtrl/widgetDataCtrl.c|loadCache|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: d->sortIndex is freed on the !keys || !d->sortIndex path and otherwise kept in the widget (freed on rebuild/destroy); the analyzer assumes free(keys) can clobber d->sortIndex.
2 src/widgets/kpunch/dbGrid/widgetDbGrid.c|dbGridBuildSortIndex|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: each successful realloc result is stored in d->columns / d->resolvedW before return.
2 src/widgets/kpunch/dbGrid/widgetDbGrid.c|dbGridSetDataWidget|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: dbGridSortMerge's merged index becomes d->sortIndex (the old one freed first; the new one freed with the grid or at the next sort); the analyzer loses the store into the caller's struct.
1 src/widgets/kpunch/dbGrid/widgetDbGrid.c|dbGridSortMerge|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: dbGridSortMerge inlined into dbGridSyncData: the same store of the merged index into d->sortIndex.
1 src/widgets/kpunch/dbGrid/widgetDbGrid.c|dbGridSyncData|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: buildImagePic keeps a copy of the picture (kept.pixels) via arrput in the help file's picture cache (pics->pics, freed by picsFree with the file); stb_ds OOM hook never returns.
1 src/widgets/kpunch/helpView/widgetHelpView.c|buildImagePic|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: the strdup'd target is stored in hv->linkTarget (the view's heap data, freed on the next link and when the widget is destroyed); the analyzer loses the store into the heap struct.
1 src/widgets/kpunch/helpView/widgetHelpView.c|helpLinkFollow|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: title strdup stored via arrput in titles, which becomes lv->ownedColTitles (NULL titles are tolerated).
1 src/widgets/kpunch/listView/widgetListView.c|basSetColumns.part.0|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: each cell copy is stored by arrput in lv->ownedCells (freed by widgetFreeOwnedStrings); stb_ds OOM hook never returns, so it cannot be dropped.
1 src/widgets/kpunch/listView/widgetListView.c|basSetRows.part.0|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: the !idx || !tmp check returns before any use; analyzer loses the merged condition at -O2. idx ends in lv->sortIndex, tmp is freed.
4 src/widgets/kpunch/listView/widgetListView.c|listViewBuildSortIndex|dereference of possibly-NULL <x> [CWE-690] [-Wanalyzer-possible-null-dereference]
# FP: the !idx || !tmp check returns before any use; analyzer loses the merged condition at -O2. idx ends in lv->sortIndex, tmp is freed.
2 src/widgets/kpunch/listView/widgetListView.c|listViewBuildSortIndex|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: the !idx || !tmp check returns before any use; analyzer loses the merged condition at -O2. idx ends in lv->sortIndex, tmp is freed.
1 src/widgets/kpunch/listView/widgetListView.c|listViewBuildSortIndex|use of possibly-NULL <x> where non-null expected [CWE-690] [-Wanalyzer-possible-null-argument]
# FP: strdups are stored in lv->ownedCells (arrput / slot replace), freed by the owned-cell free paths.
2 src/widgets/kpunch/listView/widgetListView.c|wgtListViewAddItem.part.0|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: strdup replaces lv->ownedCells[idx] (freed by the owned-cell free paths).
1 src/widgets/kpunch/listView/widgetListView.c|wgtListViewSetCell.part.0|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: listViewBuildSortIndex stores the realloc'd sort index in lv->sortIndex before returning (freed by the next rebuild or destroy); the analyzer loses the pointer through the widget's data struct.
1 src/widgets/kpunch/listView/widgetListView.c|widgetListViewOnMouse|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: the strdup'd mask is stored in ti->mask (freed by the next SetMask and with the widget); the failure path frees it.
1 src/widgets/kpunch/textInput/widgetTextInput.c|wgtTextInputSetMask|leak of <x> [CWE-401] [-Wanalyzer-malloc-leak]
# FP: item was validated non-NULL (VALIDATE_WIDGET_VOID) before the .part split; treeViewOf's loop test makes the analyzer assume NULL.
1 src/widgets/kpunch/treeView/widgetTreeView.c|treeSetExpanded|dereference of NULL <x> [CWE-476] [-Wanalyzer-null-dereference]
# FP: w validated non-NULL by VALIDATE_WIDGET_VOID before the .part split; same treeViewOf loop artefact.
1 src/widgets/kpunch/treeView/widgetTreeView.c|wgtTreeItemSetSelected.part.0|dereference of NULL <x> [CWE-476] [-Wanalyzer-null-dereference]
