DCERPC: dcerpc.iface keyword alert results differ from 5 vs 6/master
If sid 666 and 888 match there is no reason why 777 would not match.
Please see attached for comparison.
The pcap used - https://redmine.openinfosecfoundation.org/attachments/2434
6.x and master have the problem of not generating alert on sid:777
5.x is good
No data to display