From f5837e5c93b82a6bcefda2b681838d7bbc6fa125 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 21 Sep 2026 05:15:33 +0000
Subject: [PATCH 1/3] fix(OSQUERY-008): 3 review findings across 3 files

---
 osquery/tables/system/user_groups.h | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/osquery/tables/system/user_groups.h b/osquery/tables/system/user_groups.h
index 8ff929d6dcf..f6506156407 100644
--- a/osquery/tables/system/user_groups.h
+++ b/osquery/tables/system/user_groups.h
@@ -20,7 +20,7 @@
 #include <osquery/filesystem/filesystem.h>
 #include <osquery/logger/logger.h>
 
-#define EXPECTED_GROUPS_MAX 64
+constexpr int kExpectedGroupsMax = 64;
 
 #ifdef __APPLE__
 // This symbol is exported from libSystem.B and has been since 10.6.
@@ -65,14 +65,14 @@ static void getGroupsForUser(QueryData& results,
   }
   delete[] groups;
 #else
-  gid_type groups_buf[EXPECTED_GROUPS_MAX];
+  gid_type groups_buf[kExpectedGroupsMax];
   gid_type* groups = groups_buf;
-  int ngroups = EXPECTED_GROUPS_MAX;
+  int ngroups = kExpectedGroupsMax;
 
   // GLIBC version before 2.3.3 may have a buffer overrun:
   // http://man7.org/linux/man-pages/man3/getgrouplist.3.html
   if (getgrouplist(user.name, user.gid, groups, &ngroups) < 0) {
-    // EXPECTED_GROUPS_MAX was probably not large enough.
+    // kExpectedGroupsMax was probably not large enough.
     // Try a larger size buffer.
     groups = new gid_type[ngroups];
     if (groups == nullptr) {
@@ -96,3 +96,4 @@ static void getGroupsForUser(QueryData& results,
 }
 } // namespace tables
 } // namespace osquery
+

From b4d55dc871f022a66616aa78921a9fde4131c159 Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 21 Sep 2026 05:15:34 +0000
Subject: [PATCH 2/3] fix(OSQUERY-008): 3 review findings across 3 files

---
 osquery/tables/system/posix/sysctl_utils.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/osquery/tables/system/posix/sysctl_utils.h b/osquery/tables/system/posix/sysctl_utils.h
index e119f8a9eda..35b47745e94 100644
--- a/osquery/tables/system/posix/sysctl_utils.h
+++ b/osquery/tables/system/posix/sysctl_utils.h
@@ -16,7 +16,7 @@
 namespace osquery {
 namespace tables {
 
-#define CTL_MAX_VALUE 128
+constexpr int kCtlMaxValue = 128;
 
 #ifndef CTL_DEBUG_MAXID
 #define CTL_DEBUG_MAXID (CTL_MAXNAME * 2)
@@ -41,3 +41,4 @@ void genControlInfoFromName(const std::string& name,
                             const std::map<std::string, std::string>& config);
 }
 }
+

From ed7e4e59d06f38fced5aad46a559aa83205c4b9d Mon Sep 17 00:00:00 2001
From: "flamingo[bot]" <277372822+flamingo[bot]@users.noreply.github.com>
Date: Mon, 21 Sep 2026 05:15:35 +0000
Subject: [PATCH 3/3] fix(OSQUERY-008): 3 review findings across 3 files

---
 osquery/utils/info/tool_type.cpp | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/osquery/utils/info/tool_type.cpp b/osquery/utils/info/tool_type.cpp
index 3ec18c01d9f..18049a12989 100644
--- a/osquery/utils/info/tool_type.cpp
+++ b/osquery/utils/info/tool_type.cpp
@@ -14,23 +14,24 @@ namespace osquery {
 namespace {
 
 /// Current tool type.
-ToolType kToolType{ToolType::UNKNOWN};
+ToolType gToolType{ToolType::UNKNOWN};
 
 } // namespace
 
 void setToolType(ToolType tool) {
-  kToolType = tool;
+  gToolType = tool;
 }
 
 ToolType getToolType() {
-  return kToolType;
+  return gToolType;
 }
 
 bool isDaemon() {
-  return kToolType == ToolType::DAEMON;
+  return gToolType == ToolType::DAEMON;
 }
 
 bool isShell() {
-  return kToolType == ToolType::SHELL;
+  return gToolType == ToolType::SHELL;
 }
 } // namespace osquery
+