{
  "version": "1.0.0",
  "generated": "2026-05-27",
  "description": "Complete CWE-to-fold-detector mapping for Juliet C/C++ 1.3 (118 categories)",
  "total_cwes": 118,
  "target_detectors": [
    "null-deref",
    "div-by-zero",
    "int-overflow",
    "int-truncation",
    "sign-conversion",
    "oob-access"
  ],
  "cwe_entries": {
    "15": {
      "title": "External Control of System or Configuration Setting",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "No fold detector covers configuration injection or environment variable manipulation",
      "testcase_count": 79,
      "already_filtered": false
    },
    "23": {
      "title": "Relative Path Traversal",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "No path-traversal or filesystem-sandbox detector in fold",
      "testcase_count": 3907,
      "already_filtered": false
    },
    "36": {
      "title": "Absolute Path Traversal",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "No path-traversal or filesystem-sandbox detector in fold",
      "testcase_count": 3907,
      "already_filtered": false
    },
    "78": {
      "title": "Improper Neutralization of Special Elements in OS Command (OS Command Injection)",
      "fold_detector": "taint-track",
      "fold_confidence": "plausible",
      "notes": "Taint tracker can follow user input into system()/popen(). Requires interprocedural (M13) for full coverage.",
      "testcase_count": 7813,
      "already_filtered": false
    },
    "90": {
      "title": "Improper Neutralization of Special Elements in LDAP Query (LDAP Injection)",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "No LDAP-injection detector",
      "testcase_count": 781,
      "already_filtered": false
    },
    "114": {
      "title": "Process Control",
      "fold_detector": "taint-track",
      "fold_confidence": "plausible",
      "notes": "Taint from environment/argv into dlopen or exec-family functions",
      "testcase_count": 937,
      "already_filtered": false
    },
    "121": {
      "title": "Stack-based Buffer Overflow",
      "fold_detector": "oob-access",
      "fold_confidence": "primary",
      "notes": "Direct match: bounded-model OOB index check against stack array bounds",
      "testcase_count": 7889,
      "already_filtered": true
    },
    "122": {
      "title": "Heap-based Buffer Overflow",
      "fold_detector": "oob-access",
      "fold_confidence": "primary",
      "notes": "Direct match: bounded-model OOB index check. Array length from allocation call may be approximate.",
      "testcase_count": 9652,
      "already_filtered": true
    },
    "123": {
      "title": "Write-what-where Condition",
      "fold_detector": "oob-access",
      "fold_confidence": "plausible",
      "notes": "Some variants write to an arbitrary offset computed from input; may trigger OOB when index exceeds buffer size",
      "testcase_count": 236,
      "already_filtered": false
    },
    "124": {
      "title": "Buffer Underwrite",
      "fold_detector": "oob-access",
      "fold_confidence": "primary",
      "notes": "Negative index on buffer write — OOB detector catches index < 0",
      "testcase_count": 3319,
      "already_filtered": true
    },
    "126": {
      "title": "Buffer Over-read",
      "fold_detector": "oob-access",
      "fold_confidence": "primary",
      "notes": "Index >= length on buffer read — direct OOB match",
      "testcase_count": 2297,
      "already_filtered": true
    },
    "127": {
      "title": "Buffer Under-read",
      "fold_detector": "oob-access",
      "fold_confidence": "primary",
      "notes": "Negative index on buffer read — OOB detector catches index < 0",
      "testcase_count": 3319,
      "already_filtered": true
    },
    "134": {
      "title": "Use of Externally-Controlled Format String",
      "fold_detector": "taint-track",
      "fold_confidence": "plausible",
      "notes": "Taint tracker can follow user input into printf format string",
      "testcase_count": 4929,
      "already_filtered": false
    },
    "176": {
      "title": "Improper Handling of Unicode Encoding",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Unicode normalization / canonicalization issue — no fold detector",
      "testcase_count": 83,
      "already_filtered": false
    },
    "188": {
      "title": "Reliance on Data/Memory Layout",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Layout/alignment assumptions — no fold detector",
      "testcase_count": 38,
      "already_filtered": false
    },
    "190": {
      "title": "Integer Overflow (Wrap)",
      "fold_detector": "int-overflow",
      "fold_confidence": "primary",
      "notes": "Direct match: fold encodes signed arithmetic in BV and queries Z3 for overflow",
      "testcase_count": 6458,
      "already_filtered": true
    },
    "191": {
      "title": "Integer Underflow (Wrap)",
      "fold_detector": "int-overflow",
      "fold_confidence": "primary",
      "notes": "Same detector as CWE-190, different direction. Handled by int-overflow observer.",
      "testcase_count": 4732,
      "already_filtered": true
    },
    "194": {
      "title": "Unexpected Sign Extension",
      "fold_detector": "sign-conversion",
      "fold_confidence": "primary",
      "notes": "Direct match: sign-conversion detector watches implicit sign-extension casts",
      "testcase_count": 1876,
      "already_filtered": true
    },
    "195": {
      "title": "Signed to Unsigned Conversion Error",
      "fold_detector": "sign-conversion",
      "fold_confidence": "primary",
      "notes": "Direct match: sign-conversion detector watches signed→unsigned casts",
      "testcase_count": 1876,
      "already_filtered": true
    },
    "196": {
      "title": "Unsigned to Signed Conversion Error",
      "fold_detector": "sign-conversion",
      "fold_confidence": "primary",
      "notes": "Small test set — fold sign-conversion detector handles unsigned→signed explicitly",
      "testcase_count": 20,
      "already_filtered": true
    },
    "197": {
      "title": "Numeric Truncation Error",
      "fold_detector": "int-truncation",
      "fold_confidence": "primary",
      "notes": "Direct match: int-truncation detector watches implicit narrowing casts",
      "testcase_count": 1408,
      "already_filtered": true
    },
    "222": {
      "title": "Truncation of Security-relevant Information",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Audit/logging truncation — no fold detector",
      "testcase_count": 19,
      "already_filtered": false
    },
    "223": {
      "title": "Omission of Security-relevant Information",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Audit/logging omission — no fold detector",
      "testcase_count": 19,
      "already_filtered": false
    },
    "226": {
      "title": "Sensitive Information Uncleared Before Release",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Memory scrubbing — no fold detector",
      "testcase_count": 73,
      "already_filtered": false
    },
    "242": {
      "title": "Use of Inherently Dangerous Function",
      "fold_detector": "deprecated-api",
      "fold_confidence": "primary",
      "notes": "Direct match: deprecated-api detector flags gets(), sprintf(), etc.",
      "testcase_count": 20,
      "already_filtered": false
    },
    "244": {
      "title": "Improper Clearing of Heap Memory Before Release",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Memory scrubbing — no fold detector",
      "testcase_count": 73,
      "already_filtered": false
    },
    "247": {
      "title": "DEPRECATED: Reliance on DNS Lookups in a Security Decision",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Deprecated CWE, DNS lookup — no fold detector",
      "testcase_count": 19,
      "already_filtered": false
    },
    "252": {
      "title": "Unchecked Return Value",
      "fold_detector": "null-deref",
      "fold_confidence": "plausible",
      "notes": "Some variants involve unchecked malloc() return leading to null deref. Fold's null-deref detector may catch the subsequent dereference. Not all CWE-252 testcases have null-deref patterns.",
      "testcase_count": 632,
      "already_filtered": false
    },
    "253": {
      "title": "Incorrect Check of Function Return Value",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Logic error in return-value checking — fold does not model API contracts",
      "testcase_count": 686,
      "already_filtered": false
    },
    "256": {
      "title": "Plaintext Storage of a Password",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Credentials storage — no fold detector",
      "testcase_count": 165,
      "already_filtered": false
    },
    "259": {
      "title": "Use of Hard-coded Password",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Hard-coded secrets — no fold detector (static string match could work but is not implemented)",
      "testcase_count": 157,
      "already_filtered": false
    },
    "272": {
      "title": "Least Privilege Violation",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Privilege management — no fold detector",
      "testcase_count": 253,
      "already_filtered": false
    },
    "273": {
      "title": "Improper Check for Dropped Privileges",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Privilege management — no fold detector",
      "testcase_count": 37,
      "already_filtered": false
    },
    "284": {
      "title": "Improper Access Control",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Authorization logic — no fold detector",
      "testcase_count": 217,
      "already_filtered": false
    },
    "319": {
      "title": "Cleartext Transmission of Sensitive Information",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Network transmission — no fold detector",
      "testcase_count": 329,
      "already_filtered": false
    },
    "321": {
      "title": "Use of Hard-coded Cryptographic Key",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Hard-coded crypto material — no fold detector",
      "testcase_count": 157,
      "already_filtered": false
    },
    "325": {
      "title": "Missing Required Cryptographic Step",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Crypto protocol — no fold detector",
      "testcase_count": 73,
      "already_filtered": false
    },
    "327": {
      "title": "Use of a Broken or Risky Cryptographic Algorithm",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Crypto API usage — no fold detector",
      "testcase_count": 55,
      "already_filtered": false
    },
    "328": {
      "title": "Use of Weak Hash",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Crypto API usage — no fold detector",
      "testcase_count": 55,
      "already_filtered": false
    },
    "338": {
      "title": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "PRNG API usage — no fold detector",
      "testcase_count": 19,
      "already_filtered": false
    },
    "364": {
      "title": "Signal Handler Race Condition",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Concurrency — fold only does intraprocedural analysis (prior to M13)",
      "testcase_count": 20,
      "already_filtered": false
    },
    "366": {
      "title": "Race Condition within a Thread",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Concurrency — fold only does intraprocedural analysis (prior to M13)",
      "testcase_count": 38,
      "already_filtered": false
    },
    "367": {
      "title": "Time-of-check Time-of-use (TOCTOU) Race Condition",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Concurrency/filesystem — no fold detector",
      "testcase_count": 38,
      "already_filtered": false
    },
    "369": {
      "title": "Divide By Zero",
      "fold_detector": "div-by-zero",
      "fold_confidence": "primary",
      "notes": "Direct match: div-by-zero observer fires on division with path ∈ {op == 0}",
      "testcase_count": 1480,
      "already_filtered": true
    },
    "377": {
      "title": "Insecure Temporary File",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Filesystem operations — no fold detector",
      "testcase_count": 146,
      "already_filtered": false
    },
    "390": {
      "title": "Detection of Error Condition Without Action",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Error handling — no fold detector",
      "testcase_count": 92,
      "already_filtered": false
    },
    "391": {
      "title": "Unchecked Error Condition",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Error handling — no fold detector",
      "testcase_count": 56,
      "already_filtered": false
    },
    "396": {
      "title": "Declaration of Catch for Generic Exception",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "C++ exception handling — no fold detector",
      "testcase_count": 56,
      "already_filtered": false
    },
    "397": {
      "title": "Declaration of Throws for Generic Exception",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "C++ exception handling — no fold detector",
      "testcase_count": 22,
      "already_filtered": false
    },
    "398": {
      "title": "Indicator of Poor Code Quality",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Meta-quality indicator, not a specific detector target",
      "testcase_count": 183,
      "already_filtered": false
    },
    "400": {
      "title": "Uncontrolled Resource Consumption",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Resource exhaustion / unbounded allocation — no fold detector",
      "testcase_count": 1234,
      "already_filtered": false
    },
    "401": {
      "title": "Missing Release of Memory after Effective Lifetime",
      "fold_detector": "use-after-free",
      "fold_confidence": "plausible",
      "notes": "Memory leak leading to potential use-after-free. Fold's UAF detector tracks free() calls but limited to intraprocedural.",
      "testcase_count": 2710,
      "already_filtered": false
    },
    "404": {
      "title": "Improper Resource Shutdown or Release",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Resource lifecycle — no fold detector (file/socket cleanup)",
      "testcase_count": 626,
      "already_filtered": false
    },
    "415": {
      "title": "Double Free",
      "fold_detector": "use-after-free",
      "fold_confidence": "plausible",
      "notes": "Fold's UAF detector tracks free() calls. Double-free is detectable when two free() calls reach same pointer intraprocedurally.",
      "testcase_count": 1648,
      "already_filtered": false
    },
    "416": {
      "title": "Use After Free",
      "fold_detector": "use-after-free",
      "fold_confidence": "primary",
      "notes": "Direct match for fold's use-after-free detector",
      "testcase_count": 522,
      "already_filtered": false
    },
    "426": {
      "title": "Untrusted Search Path",
      "fold_detector": "taint-track",
      "fold_confidence": "plausible",
      "notes": "Search path manipulation — taint tracker may find path from environment to exec",
      "testcase_count": 314,
      "already_filtered": false
    },
    "427": {
      "title": "Uncontrolled Search Path Element",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Search path manipulation — no dedicated detector",
      "testcase_count": 782,
      "already_filtered": false
    },
    "440": {
      "title": "Expected Behavior Violation",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Too broad for a specific detector",
      "testcase_count": 3,
      "already_filtered": false
    },
    "457": {
      "title": "Use of Uninitialized Variable",
      "fold_detector": "uninit-local-read",
      "fold_confidence": "primary",
      "notes": "Direct match for fold's uninit-local-read detector",
      "testcase_count": 1083,
      "already_filtered": false
    },
    "459": {
      "title": "Incomplete Cleanup",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Resource cleanup — no fold detector",
      "testcase_count": 38,
      "already_filtered": false
    },
    "464": {
      "title": "Addition of Data Structure Sentinel",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Data structure sentinel — no fold detector",
      "testcase_count": 80,
      "already_filtered": false
    },
    "467": {
      "title": "Use of sizeof() on a Pointer Type",
      "fold_detector": "sign-conversion",
      "fold_confidence": "plausible",
      "notes": "sizeof(ptr) instead of sizeof(*ptr) results in size mismatch that can propagate as an implicit sign conversion or truncation. Fold's sign-conversion detector may catch the resulting cast.",
      "testcase_count": 56,
      "already_filtered": false
    },
    "468": {
      "title": "Incorrect Pointer Scaling",
      "fold_detector": "oob-access",
      "fold_confidence": "plausible",
      "notes": "Arithmetic on pointer without proper scaling produces out-of-bounds access. Fold's OOB detector may catch the resulting access when the computed index is out of range.",
      "testcase_count": 39,
      "already_filtered": false
    },
    "469": {
      "title": "Use of Pointer Subtraction to Determine Size",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Pointer arithmetic without proper bounds checking — no direct detector",
      "testcase_count": 38,
      "already_filtered": false
    },
    "475": {
      "title": "Undefined Behavior from Input to API",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Too broad — covers many kinds of undefined behavior",
      "testcase_count": 38,
      "already_filtered": false
    },
    "476": {
      "title": "Null Pointer Dereference",
      "fold_detector": "null-deref",
      "fold_confidence": "primary",
      "notes": "Direct match: fold's null-deref observer (M9 rewrite) queries Z3 for path ∧ (ptr == 0)",
      "testcase_count": 532,
      "already_filtered": true
    },
    "478": {
      "title": "Missing Default Case in Switch Statement",
      "fold_detector": "dead",
      "fold_confidence": "plausible",
      "notes": "Missing default cases are a completeness concern, not a dead-branch issue per se. Fold's dead-branch detector covers switch arms but this CWE asks about absence of a case.",
      "testcase_count": 20,
      "already_filtered": false
    },
    "479": {
      "title": "Signal Handler Use of Non-reentrant Function",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Signal handler safety — no fold detector",
      "testcase_count": 20,
      "already_filtered": false
    },
    "480": {
      "title": "Use of Incorrect Operator",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Wrong operator (e.g., & instead of &&) — no fold detector",
      "testcase_count": 20,
      "already_filtered": false
    },
    "481": {
      "title": "Assigning instead of Comparing",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "If-clause bug — no fold detector (pattern match, not symbolic)",
      "testcase_count": 20,
      "already_filtered": false
    },
    "482": {
      "title": "Comparing instead of Assigning",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Expression bug — no fold detector",
      "testcase_count": 20,
      "already_filtered": false
    },
    "483": {
      "title": "Incorrect Block Delimitation",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Missing braces — no fold detector (syntax-level, not symbolic)",
      "testcase_count": 22,
      "already_filtered": false
    },
    "484": {
      "title": "Omitted Break Statement in Switch",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Missing break — no fold detector (pattern match, not symbolic)",
      "testcase_count": 20,
      "already_filtered": false
    },
    "500": {
      "title": "Public Static Field Not Marked Final",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Java-specific — not applicable to C/C++",
      "testcase_count": 4,
      "already_filtered": false
    },
    "506": {
      "title": "Embedded Malicious Code",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Embedded code patterns — no fold detector",
      "testcase_count": 160,
      "already_filtered": false
    },
    "510": {
      "title": "Trapdoor",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Backdoor detection — no fold detector",
      "testcase_count": 72,
      "already_filtered": false
    },
    "511": {
      "title": "Logic/Time Bomb",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Trigger-based logic — no fold detector",
      "testcase_count": 74,
      "already_filtered": false
    },
    "526": {
      "title": "Cleartext Storage of Sensitive Information in Environment Variable",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Environment variable storage — no fold detector",
      "testcase_count": 20,
      "already_filtered": false
    },
    "534": {
      "title": "Information Exposure Through Debug Log Files",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Debug logging — no fold detector",
      "testcase_count": 37,
      "already_filtered": false
    },
    "535": {
      "title": "Information Exposure Through Shell Error Message",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Shell error disclosure — no fold detector",
      "testcase_count": 37,
      "already_filtered": false
    },
    "546": {
      "title": "Suspicious Comment",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Comment inspection — no fold detector (not a code quality tool)",
      "testcase_count": 92,
      "already_filtered": false
    },
    "561": {
      "title": "Dead Code",
      "fold_detector": "dead",
      "fold_confidence": "primary",
      "notes": "Fold splits CWE-561 across dead-branch (symbolic), dead-statement (CFG), and unused-function detectors",
      "testcase_count": 4,
      "already_filtered": true
    },
    "562": {
      "title": "Return of Stack Variable Address",
      "fold_detector": "null-deref",
      "fold_confidence": "plausible",
      "notes": "Returning address of stack-local variable creates a dangling pointer. Fold's null-deref observer may catch the subsequent dereference of the invalid pointer. Limited by intraprocedural scope.",
      "testcase_count": 5,
      "already_filtered": false
    },
    "563": {
      "title": "Assignment to Variable without Use (Unused Variable)",
      "fold_detector": "dead",
      "fold_confidence": "plausible",
      "notes": "Unused variables are dead code. Fold's dead/detector pipeline can identify these as dead statements.",
      "testcase_count": 756,
      "already_filtered": false
    },
    "570": {
      "title": "Expression is Always False",
      "fold_detector": "dead",
      "fold_confidence": "plausible",
      "notes": "Constants and tautologies. Fold's dead-branch detector handles path predicates that are UNSAT.",
      "testcase_count": 18,
      "already_filtered": false
    },
    "571": {
      "title": "Expression is Always True",
      "fold_detector": "dead",
      "fold_confidence": "plausible",
      "notes": "Constants and tautologies. Fold's dead-branch detector handles trivially SAT paths that dominate.",
      "testcase_count": 18,
      "already_filtered": false
    },
    "587": {
      "title": "Assignment of a Fixed Address to a Pointer",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Fixed-address assignment — no fold detector (not inherently a bug)",
      "testcase_count": 20,
      "already_filtered": false
    },
    "588": {
      "title": "Attempt to Access Child of a Non-structure Pointer",
      "fold_detector": "null-deref",
      "fold_confidence": "plausible",
      "notes": "MemberExpr on invalid pointer. Fold's null-deref observer hooks MemberExpr and checks for null path.",
      "testcase_count": 128,
      "already_filtered": false
    },
    "590": {
      "title": "Free of Memory not on the Heap",
      "fold_detector": "use-after-free",
      "fold_confidence": "plausible",
      "notes": "free() on stack/static memory. Fold's UAF detector may catch the invalid free path.",
      "testcase_count": 4231,
      "already_filtered": false
    },
    "591": {
      "title": "Sensitive Data Storage in Improperly Locked Memory",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Memory protection — no fold detector",
      "testcase_count": 157,
      "already_filtered": false
    },
    "605": {
      "title": "Multiple Binds to the Same Port",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Network binding — no fold detector",
      "testcase_count": 20,
      "already_filtered": false
    },
    "606": {
      "title": "Unchecked Input for Loop Condition",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Loop-condition checking — no fold detector; fold unrolls loops (bounded model)",
      "testcase_count": 822,
      "already_filtered": false
    },
    "615": {
      "title": "Information Exposure Through Comments",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Comment inspection — no fold detector",
      "testcase_count": 19,
      "already_filtered": false
    },
    "617": {
      "title": "Reachable Assertion",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Assertion reachability — fold does not model assertion semantics",
      "testcase_count": 488,
      "already_filtered": false
    },
    "620": {
      "title": "Unverified Password Change",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Authentication flow — no fold detector",
      "testcase_count": 19,
      "already_filtered": false
    },
    "665": {
      "title": "Improper Initialization",
      "fold_detector": "uninit-local-read",
      "fold_confidence": "plausible",
      "notes": "Partially initialized structures. Fold's uninit-local-read detector tracks individual field initialization. Some CWE-665 testcases have struct fields read before init.",
      "testcase_count": 316,
      "already_filtered": false
    },
    "666": {
      "title": "Operation on Resource in Wrong Phase of Lifetime",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Resource lifecycle — no fold detector",
      "testcase_count": 92,
      "already_filtered": false
    },
    "667": {
      "title": "Improper Locking",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Concurrency/locking — no fold detector",
      "testcase_count": 20,
      "already_filtered": false
    },
    "672": {
      "title": "Operation on a Resource after Expiration or Release",
      "fold_detector": "use-after-free",
      "fold_confidence": "plausible",
      "notes": "Use-after-close for file descriptors / sockets. Fold's UAF detector is memory-focused but may generalize.",
      "testcase_count": 83,
      "already_filtered": false
    },
    "674": {
      "title": "Uncontrolled Recursion",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Recursion depth — fold does not model interprocedural call depth (prior to M13)",
      "testcase_count": 4,
      "already_filtered": false
    },
    "675": {
      "title": "Multiple Operations on Resource in Single-Operation Context",
      "fold_detector": "use-after-free",
      "fold_confidence": "plausible",
      "notes": "Duplicate close/free. Fold's UAF detector may catch second free() on same pointer.",
      "testcase_count": 330,
      "already_filtered": false
    },
    "676": {
      "title": "Use of Potentially Dangerous Function",
      "fold_detector": "deprecated-api",
      "fold_confidence": "primary",
      "notes": "Direct match: deprecated-api detector. Functions like strcpy, sprintf, gets are flagged.",
      "testcase_count": 20,
      "already_filtered": false
    },
    "680": {
      "title": "Integer Overflow to Buffer Overflow",
      "fold_detector": "int-overflow",
      "fold_confidence": "primary",
      "notes": "The overflow itself is an int-overflow pattern. Cascading into buffer overflow is the OOB detector's concern. Primary mapping via int-overflow; OOB is a secondary effect.",
      "testcase_count": 938,
      "already_filtered": false
    },
    "681": {
      "title": "Incorrect Conversion between Numeric Types",
      "fold_detector": "int-truncation",
      "fold_confidence": "primary",
      "notes": "Widening or narrowing conversions that lose precision. Fold's int-truncation detector catches narrowing casts.",
      "testcase_count": 56,
      "already_filtered": false
    },
    "685": {
      "title": "Function Call With Incorrect Number of Arguments",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Signature mismatch — compilers already catch these. Not a fold concern.",
      "testcase_count": 20,
      "already_filtered": false
    },
    "688": {
      "title": "Function Call With Incorrect Variable or Reference as Argument",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Wrong argument — no fold detector (API contract modeling)",
      "testcase_count": 20,
      "already_filtered": false
    },
    "690": {
      "title": "Unchecked Return Value to NULL Pointer Dereference",
      "fold_detector": "null-deref",
      "fold_confidence": "primary",
      "notes": "malloc()/calloc() return value not checked for NULL before dereference. Fold's null-deref observer checks path ∧ (ptr == 0) at deref sites — should catch these when the allocator return feeds the deref.",
      "testcase_count": 1564,
      "already_filtered": false
    },
    "758": {
      "title": "Reliance on Undefined, Unspecified, or Implementation-Defined Behavior",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Too broad — encompasses many patterns across different detectors",
      "testcase_count": 583,
      "already_filtered": false
    },
    "761": {
      "title": "Free of Pointer not at Start of Buffer",
      "fold_detector": "use-after-free",
      "fold_confidence": "plausible",
      "notes": "free(ptr + offset) instead of free(ptr). Fold's UAF detector may catch the mismatched allocation.",
      "testcase_count": 938,
      "already_filtered": false
    },
    "762": {
      "title": "Mismatched Memory Management Routines",
      "fold_detector": "use-after-free",
      "fold_confidence": "plausible",
      "notes": "new[]/delete or malloc/delete mismatch. Fold's UAF detector may catch the mismatched deallocation.",
      "testcase_count": 6106,
      "already_filtered": false
    },
    "773": {
      "title": "Missing Reference to Active File Descriptor or Handle",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "File descriptor lifecycle — no fold detector",
      "testcase_count": 236,
      "already_filtered": false
    },
    "775": {
      "title": "Missing Release of File Descriptor or Handle after Effective Lifetime",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "File descriptor leak — no fold detector",
      "testcase_count": 236,
      "already_filtered": false
    },
    "780": {
      "title": "Use of RSA Algorithm without OAEP",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Crypto API usage — no fold detector",
      "testcase_count": 19,
      "already_filtered": false
    },
    "785": {
      "title": "Use of Path Manipulation Function without Maximum-sized Buffer",
      "fold_detector": "oob-access",
      "fold_confidence": "plausible",
      "notes": "Path manipulation functions like realpath() with insufficient buffer. Fold's OOB detector may catch buffer overflows if the write target array bounds are known.",
      "testcase_count": 19,
      "already_filtered": false
    },
    "789": {
      "title": "Memory Allocation with Excessive Size Value",
      "fold_detector": "int-overflow",
      "fold_confidence": "plausible",
      "notes": "Allocation size computed from user input without bounds check, leading to overflow in size computation. The overflow itself is an int-overflow pattern.",
      "testcase_count": 1644,
      "already_filtered": false
    },
    "832": {
      "title": "Unlock of a Resource that is not Locked",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Locking protocol — no fold detector",
      "testcase_count": 20,
      "already_filtered": false
    },
    "835": {
      "title": "Loop with Unreachable Exit Condition (Infinite Loop)",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Loop termination — fold uses bounded unrolling (k=3)",
      "testcase_count": 8,
      "already_filtered": false
    },
    "843": {
      "title": "Access of Resource Using Incompatible Type (Type Confusion)",
      "fold_detector": null,
      "fold_confidence": "none",
      "notes": "Type confusion / punning — no fold detector",
      "testcase_count": 128,
      "already_filtered": false
    }
  }
}