src/mem/localalloc.h (8 lines):
	- line 280: // from lazy_init is the originating allocator.  (TODO: but note that this
	- line 285: dealloc(p.unsafe_ptr()); // TODO don't double count statistics
	- line 469: * TODO In CHERI+MTE, this, is part of the CAmoCDecVersion instruction;
	- line 480: * TODO In the CHERI+MTE case, we must reconstruct the pointer for the
	- line 500: * TODO Further, in the CHERI+MTE case, the tag check will be implicit in
	- line 567: * TODO: Unsurprisingly, the CHERI+MTE case once again has something to
	- line 666: // TODO: Should this be tested even in the !CHECK_CLIENT case?
	- line 707: // TODO What's the domestication policy here?  At the moment we just


src/mem/corealloc.h (7 lines):
	- line 333: // TODO: This is a capability amplification as we are saying we
	- line 381: // TODO delay the clear to the next user of the slab, or teardown so
	- line 402: // TODO: Handle message queue on this path?
	- line 539: // TODO this needs to not double count stats
	- line 540: // TODO this needs to not double revoke if using MTE
	- line 541: // TODO thread capabilities?
	- line 652: // stats().remote_post();  // TODO queue not in line!


src/mem/localcache.h (3 lines):
	- line 35: // TODO: Should this be zeroing the free Object state, in the non-zeroing
	- line 54: // TODO: Minimal stats object for just the stats on this datastructure.
	- line 89: // TODO could optimise this, to return the whole list in one append


src/mem/freelist.h (3 lines):
	- line 112: * TODO: Consider putting prev_encoded at the end of the object, would
	- line 131: // TODO: Should really use C++20 atomic_ref rather than a union.
	- line 268: * TODO: We'd like, in some sense, to more tightly couple or integrate


src/backend/pagemap.h (3 lines):
	- line 121: // TODO take account of pagemap size in the calculation of how big it
	- line 132: // TODO CHERI capability bound here!
	- line 138: // TODO CHERI capability bound here!


src/backend/backend.h (1 line):
	- line 103: // TODO: This is leaking `meta`. Currently there is no facility for


src/pal/pal_posix.h (1 line):
	- line 148: // TODO: the backtrace mechanism does not yet work on CHERI, and causes


src/pal/pal_consts.h (1 line):
	- line 19: * TODO: There is a known bug in CheriBSD that means round-tripping through


src/mem/allocstats.h (1 line):
	- line 39: // TODO reestablish checks, when we sanitise the stats.


src/mem/chunkallocator.h (1 line):
	- line 252: // TODO handle bounded versus lazy pagemaps in stats


src/pal/pal_linux.h (1 line):
	- line 89: // TODO: If the system call fails then the POSIX PAL calls libc


src/backend/address_space_core.h (1 line):
	- line 24: * TODO: This manages pieces of memory smaller than (1U << MIN_CHUNK_BITS) to


src/mem/sizeclasstable.h (1 line):
	- line 14: * TODO:  Due to the current structure for constexpr evaluation this file does


src/mem/metaslab.h (1 line):
	- line 311: // TODO: perhaps remove static_cast with resolution of