Suricata

With the default configuration, ie autofp-scheduler: hash the first packet of FTP-data can be processed before the expectation gets created, depending on the scheduling of the threads

A workaround is to use autofp-scheduler: ippair