# ZeroPath scan overview — yesterday + today

Two ZeroPath scans were processed:
- `yesterday.json` (scanned 2026-05-14): 67 raw findings — 43 cyrus-imapd C findings triaged; 19 libical + 5 CI excluded at the gate.
- `today.json` (rescan with different settings): 59 raw findings — 38 net-new C findings triaged; 21 redundant with yesterday.

Columns:
- **Real?** — `likely` = real-bug verdict; `uncertain` = deferred for more eyes; `no` = false-positive; `n/a` = excluded at gate / redundant (not separately triaged).
- **Branch** — `zp-fix/...` if there's a fix branch in flight; `—` plus a note if deferred; blank if no action needed.

IDs are truncated to first 8 hex chars; full IDs are in the raw JSON files.

## Yesterday — 67 findings

### Likely real (19)

| ID | Problem | ZP impact | Real? | Branch | Notes |
|---|---|---|---|---|---|
| `059cbd9c` | http_caldav_sched.c: NULL dereference in iSchedule parsing | crash | likely | zp-fix/ischedule-response-npd | iSchedule peer omits <request-status> → strncmp(NULL,…). |
| `f0c37067` | http_dav_sharing.c: NULL dereference in share-access parser | crash | likely | zp-fix/dav-sharing-npd | Empty <share-access/> → deref NULL share->name. |
| `c284b0a6` | http_rss.c: XML injection in RSS author | XSS | likely | zp-fix/http-rss-escaping | Atom <name>/<email> emitted without escaping. |
| `1a01766e` | http_rss.c: HTML injection in address display | stored XSS | likely | zp-fix/http-rss-escaping | Unescaped From display name / mailbox / domain → stored XSS. |
| `a237aad6` | http_rss.c: Raw HTML message XSS | stored XSS | likely | — (deferred: feature decision) | Raw text/html message rendering — needs sandboxed iframe / sanitizer or feature removal. |
| `c36915ce` | http_rss.c: MIME metadata HTML injection | XSS | likely | zp-fix/http-rss-escaping | MIME filename param unescaped in alt="…". |
| `8deb296f` | http_ws.c: Unbounded WebSocket decompression | memory DoS | likely | zp-fix/ws-zip-bomb | permessage-deflate zip bomb can OOM the worker. |
| `7b892560` | httpd.c: HTTP Host Header Injection | reflected XSS | likely | zp-fix/httpd-host-xss | Host header reflected into TLS-required redirect HTML. |
| `d05a3af9` | itip_support.c: Null deref in iTIP reply parsing | crash | likely | zp-fix/itip-reply-npd | Malformed iTIP REPLY: no ATTENDEE / no DTSTAMP → NULL deref. |
| `b1676dec` | jmap_api.c: Remote Mailbox ACL Write | ACL bypass | likely | cyr-3018-mailbox-sharewith-acl (pre-existing) | JACL_LOOKUP sharee can rewrite ACLs via Mailbox/set. |
| `901a99e2` | jmap_mail_query.c: Unbounded filter recursion | stack-overflow DoS | likely | zp-fix/jmap-filter-depth | Unbounded nesting of JMAP filter conditions → stack overflow. |
| `a1155fd2` | jmap_mail_query.c: Unbounded filter DoS | memory DoS | likely | zp-fix/jmap-filter-depth | Iterative twin of the recursive filter walk; same fix. |
| `ee7572d9` | jmap_vacation.c: Sieve script injection | code injection | likely | zp-fix/jmap-vacation-sieve-injection | Auth'd user can inject Sieve commands via subject/body. |
| `a2b1a181` | message.c: Unbounded BODYSTRUCTURE recursion | DoS | likely | zp-fix/message-bodystructure-recursion | Deeply-nested message/rfc822 crashes the parser; cap at boundary_limit. |
| `ab6eaf60` | pop3d.c: POP3 userid stack overflow | code exec / crash | likely | zp-fix/pop3d-userid-overflow | popsubfolders + remote backend → 1000-byte authid overflows 510-byte userid. |
| `5bc5f0e4` | smmapd.c: Stack overflow in protocol parser | code exec / crash | likely | zp-fix/smmapd-overflow | Unauth netstring length unbounded → stack overflow. |
| `d2439743` | tls.c: Disabled TLS certificate verification | MITM | likely | zp-fix/tls-client-verify | SSL_VERIFY_NONE hardcoded on client side; murder/HTTP-proxy MITM. |
| `4514e08e` | xcal.c: NULL dereference in xCal parsing | crash | likely | zp-fix/xcal-npd | xCal <vevent/> with no children → syslog(node->name) on NULL. |
| `49099859` | imclient.c: SASL decode failure continues | code exec / crash | likely | — (deferred: client-side bundle) | Uninitialized vars used after sasl_decode failure; imtest/Perl bindings only. |

### Uncertain (4)

| ID | Problem | ZP impact | Real? | Branch | Notes |
|---|---|---|---|---|---|
| `1e6fb5b4` | dlist.c: Unbounded dlist recursion | stack-overflow DoS | uncertain | — (deferred) | Unbounded recursion; only over trusted replication/mupdate channels. |
| `f08a3cee` | http_tzdist.c: Unbounded TZ type array write | code exec / crash | uncertain | — (deferred) | types[256] unchecked write — admin-installed zoneinfo only. |
| `689b8ed2` | message.c: Body cache parse overread | info leak / crash | uncertain | — (deferred) | Body-cache parse overread past v5/8/9 conditionals — author XXX comment notes incomplete check. |
| `ee28fecd` | bc_eval.c: Unbounded Sieve regex execution | CPU DoS | uncertain | — (deferred) | POSIX regex ReDoS; user-authored regex against own mail (self-DoS). |

### Likely FP (20)

| ID | Problem | ZP impact | Real? | Branch | Why not |
|---|---|---|---|---|---|
| `2590d4e3` | cunit/key.pem: Exposed Private Key in cunit/key.pem | credential exposure | no | — | Throwaway self-signed cert; test fixture only, not installed. |
| `af90dfe8` | annotate.c: Out-of-bounds annotate parse | info leak / crash | no | — | make_entry writes self-consistent records; OOB requires DB corruption. |
| `c79ca56e` | arbitron.c: Stack overflow in subscription callback | code exec / crash | no | — | DB keys are mailbox names ≤ MAX_MAILBOX_NAME (510) < buffer. |
| `d87f47e4` | caldav_alarm.c: Shared EmailSubmission Auth Confusion | ACL bypass | no | — | jmap_api.c rejects EmailSubmission/set on shared accounts. |
| `275755df` | fetchnews.c: Unbounded sscanf stack overflow | code exec / crash | no | — | prot_fgets already caps at 4095; source ≤ destination. |
| `486ea35d` | haproxy.c: Unbounded PROXY v1 sscanf | code exec / crash | no | — | Source union ≤ 232 bytes; destinations are NI_MAXHOST (1025). |
| `dde057b1` | http_caldav_sched.c: NULL dereference on malformed ICS | crash | no | — | Both callers pre-check comp/uid/prop/organizer non-NULL. |
| `28cbac06` | http_dblookup.c: Potential cross-account group disclosure | ACL bypass | no | — | Endpoint is documented unauth-by-design for trusted internal callers. |
| `3dc26d73` | http_rss.c: Unescaped Atom link href | XSS | no | — | http_proto_host only honors Forwarded from trusted murder peers. |
| `be1e8674` | http_rss.c: Unescaped RSS HTML output | XSS | no | — | mboxname is internal; mboxname_policycheck forbids <>"&\. |
| `6767490a` | jmap_api.c: Missing create type check | DoS | no | — | args already asserted as JSON object at line 252. |
| `f314dc0f` | jmap_mail_query_parse.c: Unsafe language string indexing | info leak / crash | no | — | Jansson NUL-terminates; && short-circuits before any over-read. |
| `d000f178` | mboxlist.c: Abort on DB retry state | DoS | no | — | Internal-state assertion in non-transactional admin path. |
| `dea4c3ec` | saslclient.c: Off-by-one heap overflow | code exec / crash | no | — | Standard sasl_secret_t flex-array idiom; allocation is correct. |
| `7954d84a` | smmapd.c: Unprotected backend quota proxy | info disclosure | no | — | See deferred: dead murder-backend proxy branch (port 12345 has no listener). |
| `1e698b3d` | tls.c: Out-of-bounds ALPN parse | info leak / crash | no | — | OpenSSL's tls_parse_ctos_alpn validates ProtocolNameList framing before callback. |
| `9f6a0080` | twom.c: Untrusted mmap record parsing | mem corruption | no | — | DB file lives under cyrus prefix; admin/local-root trust boundary. |
| `d2887731` | wildmat.c: Recursive wildcard DoS | DoS | no | — | Lars-Mathiesen ABORT optimization bounds depth by * count, not text length. |
| `8486ca74` | perl/lex.c: Unbounded Sieve literal allocation | memory DoS | no | — | Client-side Perl sieveshell; data flows server→client only. |
| `ef665c23` | bc_parse.c: Unbounded bytecode string parsing | info leak / crash | no | — | Sieve bytecode is server-compiled; ManageSieve only accepts source. |

### Excluded at gate — libical (19)

Vendored upstream. Defer to the libical repo.

| ID | File:line | ZP title | ZP impact |
|---|---|---|---|
| `d496d609` | `src/libical/icalarray.c:135` | Unchecked array chunk indexing | info leak / crash |
| `a7bee8d5` | `src/libical/icalcomponent.c:1090` | Recurrence parsing resource exhaustion | DoS |
| `49ac5582` | `src/libical/icalparameter.c:99` | Shallow clone cleanup bug | crash / heap corruption |
| `06d20f65` | `src/libical/icalparser.c:346` | Empty-string OOB read | info leak / crash |
| `1539b33a` | `src/libical/icalparser.c:388` | Out-of-bounds comma check | info leak / crash |
| `221d176b` | `src/libical/icalparser.c:742` | Unbounded component nesting | memory DoS |
| `a2ba4f2f` | `src/libical/icalproperty.c:596` | NULL dereference in parameter formatting | crash |
| `2cb0d0d0` | `src/libical/icalrecur.c:938` | Unbounded RRULE COUNT | memory DoS |
| `ab5646b9` | `src/libical/icalrecur.c:1785` | ICU length unit mismatch | code exec / crash |
| `e6828388` | `src/libical/icaltimezone.c:947` | Invalid timezone index use | info leak / crash |
| `5bb13910` | `src/libical/icaltimezone.c:2285` | Windows zoneinfo buffer overflow | code exec / crash |
| `e53b146d` | `src/libical/icaltimezone_p.c:466` | TZif allocation overflow | mem corruption |
| `f94c3df6` | `src/libical/icalvalue.c:1001` | Unbounded strlen on attach data | info leak / crash |
| `52ed645b` | `src/libicalss/icaldirset.c:443` | SQL-like query injection | SQL injection |
| `a6148e7e` | `src/libicalvcard/vcardtime.c:194` | VCard time buffer overflow | code exec / crash |
| `311ca3af` | `vzic/vzic-output.c:505` | Vzic path buffer overflow | code exec / crash |
| `84bfca8e` | `vzic/vzic-output.c:555` | Symlink file clobber in vzic | arbitrary file access |
| `09acadee` | `vzic/vzic-output.c:2044` | Stack overflow in RRULE formatting | code exec / crash |
| `6ef2e121` | `vzic/vzic.c:165` | Stack overflow in vzic paths | code exec / crash |

### Excluded at gate — CI / supply-chain (5)

GitHub Actions workflow hygiene. Out of scope for this triage run.

| ID | File | ZP title | ZP impact |
|---|---|---|---|
| `c7117f1f` | `.github/workflows/docs.yaml` | Dependency Vulnerability: Unpinned Action Reference in docs… | supply chain |
| `8331b988` | `.github/workflows/lint.yaml` | Unpinned GitHub Actions Dependency in lint.yaml | supply chain |
| `2a5c54ab` | `.github/workflows/publish-site.yaml` | Excessive Permissions in GitHub Actions Workflow | ACL bypass |
| `2f793784` | `.github/workflows/publish-site.yaml` | Excessive Permissions in GitHub Actions Workflow | authz bypass |
| `67a06f00` | `.github/workflows/publish-site.yaml` | Unpinned GitHub Action Dependency in publish-site.yaml | supply chain |

## Today — 59 findings

### Likely real (9)

| ID | Problem | ZP impact | Real? | Branch | Notes |
|---|---|---|---|---|---|
| `e35e0e4f` | httpd.c: Reflected XSS in error pages | XSS | likely | zp-fix/httpd-host-xss | HTML-escape `host` and `port` (and ideally error_message(code) and txn->error.desc) via the existing buf_appe… |
| `caca1a3b` | jmap_mail_submission.c: Null Deref on Submission Parse | crash | likely | zp-fix/jmap-submission-bugs | After json_loadb, bail (or skip the rewrite block) when sub is NULL or json_string_value(json_object_get(sub,… |
| `a0e9f899` | jmap_mailbox.c: Recursive filter stack exhaustion | DoS | likely | zp-fix/jmap-filter-depth | Merge zp-fix/jmap-filter-depth (caps in jmap_filter_parse_internal); that walker validates Mailbox/query filt… |
| `0a984f55` | lmtpengine.c: LMTP return-path OOB access | code exec / crash | likely | zp-fix/lmtpengine-retpath-underflow | Add an explicit length check: if rpath starts with '<' require strlen >= 2, or guard 'if (sl >= 1 && rpath[sl… |
| `6f65b056` | saslclient.c: Unchecked IMAP literal length | code exec / crash | likely | — (deferred: client-side bundle) | Reject or close the connection if atoi(buf+1) >= AUTH_BUF_SIZE - 3 before entering the prot_read loop. |
| `63080c6e` | smtpclient.c: SMTP command injection | command injection | likely | zp-fix/jmap-submission-bugs | Reject addresses containing any of `\r`, `\n`, `<`, `>`, or non-printable chars in address_to_smtp() (or have… |
| `e978c47d` | twom.c: Incorrect mmap failure check | crash | likely | zp-fix/twom-mmap-failure-check | Replace each `if (!file->base)` near an mmap call (twom.c:525, 1668, 1821) with `if (file->base == MAP_FAILED… |
| `4b32b589` | perl/isieve.c: Heap overflow in referral mechlist rewrite | code exec / crash | likely | — (deferred: client-side bundle) | Allocate newlist as strlen(mechlist)+1 only after computing the post-rewrite size, or just snprintf into a fr… |
| `20c6eb9f` | bc_parse.c: Unsafe bytecode format concatenation | code exec / crash | likely | zp-fix/bc-parse-static-buf | Drop the `static`: use a stack-local `char buf[MAX_ARGS+2]` (or build the string into a `struct buf`) and snp… |

### Uncertain (1)

| ID | Problem | ZP impact | Real? | Branch | Notes |
|---|---|---|---|---|---|
| `d500787e` | idlemsg.c: Unchecked length drives JSON parse | memory DoS | uncertain | — (deferred) | idlemsg.c:181-183 reads an attacker-supplied size_t with MSG_PEEK, then at 196 does buf_truncate(&buf, size +… |

### Likely FP (28)

| ID | Problem | ZP impact | Real? | Branch | Why not |
|---|---|---|---|---|---|
| `1615c32f` | backend.c: Heap overflow in mechlist intersection | code exec / crash | no | — | intersect_mechlists() (imap/backend.c:521-578) only emits tokens taken verbatim from 'config', separated by s… |
| `0efefcae` | conversations.c: Unbounded conversation count write | code exec / crash | no | — | conversations.h:154 declares `uint32_t counts[32]`, and the writer at conversations.c:947-954 emits `flagcoun… |
| `2af6df9e` | http_caldav_sched.c: Outbound iMIP SMTP send | email injection | no | — | This is the documented purpose of iMIP — invitations and RSVPs sent to attendees the (authenticated) organize… |
| `e5bf62f4` | http_ischedule.c: Unauthenticated domainkey file read | arbitrary file access | no | — | The construction `config_dir + txn->req_uri->path` (http_ischedule.c:1011-1013) is constrained by two upstrea… |
| `4187c7d1` | http_jmap.c: NULL dereference in JMAP logging | crash | no | — | When parse_json_body fails or JMAP_LIMIT_SIZE trips (imap/http_jmap.c:1443-1450), req stays NULL and executio… |
| `8350f085` | http_proxy.c: Forwarded header injection | header injection | no | — | `proto` is the string literal "http" or "https" (httpd.c:511). |
| `9c467c01` | http_proxy.c: Backend HTTP request injection | request smuggling | no | — | All client-derived values written here have already passed through Cyrus's HTTP/header parsers, which structu… |
| `1e67ad22` | http_webdav.c: WebDAV header injection | header injection | no | — | Every value funneled into the fprintf header writes in dav_util.c:97-166 (User-Agent, From, Subject, Date, Me… |
| `19a3c956` | imap_proxy.c: Stack overflow in IMAP proxy parser | code exec / crash | no | — | Traced eol[128] growth in pipe_command() (imap_proxy.c:300-406). |
| `aaa74200` | imap_proxy.c: Negative read size to fwrite | info leak / crash | no | — | lib/prot.c:1388 prot_read() signature returns int but the body only ever assigns size (size_t, capped to s->c… |
| `08c54c2f` | index.c: Untrusted iCalendar Parsing | DoS | no | — | imap/index.c:4548-4569 hands raw MIME-decoded bytes to icalparser_parse_string() with no pre-validation. |
| `ca15bbc4` | jmap_mail_query.c: Remote MIME parsing sink | DoS | no | — | imap/jmap_mail.c:14547-14548 forwards client-supplied "mime" string to jmap_email_matchmime_new(), which call… |
| `2f937cc7` | jmap_notes.c: Unbounded JMAP note-set processing | DoS | no | — | ZeroPath claims no quota check. |
| `2aabe0e2` | jmap_util.c: Unbounded JSON patch recursion | DoS | no | — | Callers (jmap_calendar.c:4702/4852/4967, jmap_ical.c:2054, jmap_contact.c:4620, jmap_notif.c:398, http_caldav… |
| `97f18b2b` | message.c: Unbounded literal parsing | code exec / crash | no | — | parse_nstring() at message.c:2907 is called only on cached envelope text produced by Cyrus itself (callers in… |
| `f7484d72` | message.c: Envelope length underflow | info leak / crash | no | — | CACHE_ENVELOPE is generated by Cyrus's own message_parse routines (see imap/message.c and the wrapping '(...)… |
| `3f1c8efb` | mupdate.c: Heap overflow in mupdate ACL copy | code exec / crash | no | — | struct mbent (imap/mupdate.h:54-60) ends with 'char acl[1]' — a classic struct-hack flex array with one byte … |
| `5d3991c1` | nntpd.c: CRLF injection in To header | email header injection | no | — | The recipient string at nntpd.c:3752-3754 comes from annotatemore_lookup(IMAP_ANNOT_NS "news2mail", ...). |
| `5cabbbe3` | nntpd.c: Unsanitized NNTP response output | CRLF injection | no | — | msg->id is set at nntpd.c:3001 from spool_getheader("message-id"), which is populated by spool_fill_hdrcache(… |
| `2eebad71` | search_xapian.c: Unsigned truncation underflow | mem corruption | no | — | search_xapian.c:2406-2412 clamps `len = config_search_maxsize - tr->part_total` only when `part_total + len >… |
| `1abae1fa` | sievedir.c: Untrusted Sieve path write | arbitrary file access | no | — | sievedir_valid_name (sievedir.c:133-148) rejects names containing `/` or NUL and enforces SIEVEDIR_MAX_NAME_L… |
| `1a5e9b36` | squat.c: Out-of-bounds SQUAT parsing | info leak / crash | no | — | squat.c:649 (`p = *s++`), 667 (`count = *s++ + 1`), 669 (`s += count`), 684 (`base[offset]`), and 719 (`s = t… |
| `957b3a42` | userdeny_db.c: Fail-open denylist check | ACL bypass | no | — | The function's doc-comment (userdeny_db.c:74-76) explicitly states the contract: return 1 if a matching deny … |
| `ab4e67b9` | vcard_support.c: Client XML parsing sink | XML DoS | no | — | Site is already up to current best practice as of 4f7bc08fd9: imap/vcard_support.c:84-87 passes XML_PARSE_NOE… |
| `9f1bd52a` | imtest/imtest.c: SASL auth command overflow | code exec / crash | no | — | imtest is a manual diagnostic client (imtest/imtest.c), not a network service. |
| `779d295b` | perl/isieve.c: Arbitrary outbound Sieve connection | SSRF | no | — | isieve.c:67 init_net is a thin getaddrinfo/connect wrapper used by the sieveshell client library. |
| `573a4ba3` | perl/request.c: Unescaped ManageSieve script upload | command injection | no | — | request.c:199 frames PUTSCRIPT "%s" with the caller-supplied scriptname. |
| `b8b03fbc` | timsieved/lex.c: Oversized literal causes discard loop DoS | memory DoS | no | — | At lex.c:222-229 a literal whose decimal count exceeds maxscriptsize (default 32K per lib/imapoptions/sieve_m… |

### Redundant with yesterday (21)

Classified by file+lines+vulnClass overlap; not separately re-triaged. Dispositions inherit from yesterday.

| ID | Problem | ZP impact | Cross-ref / disposition |
|---|---|---|---|
| `49487755` | .github/workflows/docs.yaml: Dependency Vulnerability: Unpinned Action Reference in… | supply chain | = yesterday `c7117f1f` (exact match) — excluded/FP |
| `96634013` | .github/workflows/lint.yaml: Unpinned GitHub Actions Dependency in lint.yaml | supply chain | = yesterday `8331b988` (exact match) — excluded/FP |
| `52cce1c6` | .github/workflows/publish-site.yaml: Excessive Permissions in GitHub Actions Workflow | ACL bypass | = yesterday `2a5c54ab` (exact match) — excluded/FP |
| `74138562` | .github/workflows/publish-site.yaml: Excessive Permissions in GitHub Actions Workflow | authz bypass | = yesterday `2f793784` (exact match) — excluded/FP |
| `7de32781` | .github/workflows/publish-site.yaml: Unpinned GitHub Action Dependency in publish-site.yaml | supply chain | = yesterday `67a06f00` (exact match) — excluded/FP |
| `e559a0f9` | cunit/key.pem: Exposed Private Key in cunit/key.pem | credential exposure | = yesterday `2590d4e3` (exact match) — excluded/FP |
| `9236322e` | fetchnews.c: NNTP response parsing overflow | code exec / crash | same file+class as yesterday `275755df` — same FP |
| `9b0feea8` | http_tzdist.c: TZif type array overflow | code exec / crash |  — yesterday uncertain (admin zoneinfo) |
| `b073b665` | jmap_api.c: Unbounded JMAP filter recursion | DoS | same file+class as yesterday `6767490a` — fixed in `zp-fix/jmap-filter-depth` |
| `09fa6e2f` | jmap_vacation.c: Sieve script injection | code injection | = yesterday `ee7572d9` (line drift) — fixed in `zp-fix/jmap-vacation-sieve-injection` |
| `dbb9f984` | message.c: Unbounded BODYSTRUCTURE recursion | stack-overflow DoS |  — fixed in `zp-fix/message-bodystructure-recursion` |
| `65197ea9` | message.c: Unbounded BODYSTRUCTURE allocation | DoS | same file+class as yesterday `a2b1a181` — fixed in `zp-fix/message-bodystructure-recursion` |
| `a8077c1e` | message.c: Bodystructure cache OOB read | info leak / crash | same file+class as yesterday `689b8ed2` — yesterday uncertain (body-cache overread) |
| `40aa9aca` | pop3d.c: Stack overflow in proxy userid | code exec / crash |  — fixed in `zp-fix/pop3d-userid-overflow` |
| `6b999854` | smmapd.c: Cleartext backend token relay | info disclosure |  — yesterday deferred (dead code) |
| `5ac35d0f` | smmapd.c: Smmapd netstring overflow | code exec / crash |  — fixed in `zp-fix/smmapd-overflow` |
| `3c3b7eb2` | imclient.c: SASL decode error continues | varies |  |
| `409eb4e3` | twom.c: Unsafe twom record parsing | info leak / crash |  — same FP |
| `ecbb7361` | wildmat.c: Wildcard backtracking DoS | CPU DoS |  — same FP |
| `3ef4d0e0` | perl/lex.c: Unbounded Sieve literal allocation | memory DoS | = yesterday `8486ca74` (exact match) — same FP as yesterday |
| `a9e3a0ad` | bc_parse.c: Unsafe bytecode string length | info leak / crash | same file+class as yesterday `ef665c23` — same FP |

---

## Summary tallies

| Bucket | Yesterday | Today | Total |
|---|---:|---:|---:|
| Likely real | 19 | 9 | 28 |
| Uncertain | 4 | 1 | 5 |
| Likely FP | 20 | 28 | 48 |
| Excluded at gate (libical) | 19 | 0 | 19 |
| Excluded at gate (CI) | 5 | 0 | 5 |
| Redundant with yesterday | 0 | 21 | 21 |
| **Total** | **67** | **59** | **126** |