Suricata

RFC 2132 states that client id "MAY consist of a hardware type and hardware address.", not that it must. [https://datatracker.ietf.org/doc/html/rfc2132#section-9.14]
Please look at the example below, which represents a real mac address:
3d 06 4c d9 8f ed bc a4
In this case, the payload does not contain a hardware-type byte, and the full 6-byte sequence represents the Client Identifier.
However, the parser incorrectly interprets the first payload byte (4c) as the hardware type and logs only the remaining five bytes as the ID:
"client_id":"d9:8f:ed:bc:a4"
The byte 4c should instead be treated as part of the ID rather than as a hardware type.