Suricata

if stream frame is not enabled, it does not get created, and other enabled frames may be created and be the first. see use of FrameConfigTypeIsEnabled

This resulted that this other frame could get its length updated on stream end, which would lead to false positives (if the length grew)