Suricata

Which fuzz target did you use ? With which sanitizer and options ?

It's still the case for current main branch commit (8455efd9ac9be052f5f5424805559611e8531b16)

tmqh-packetpool.c:351:42: runtime error: implicit conversion from type 'int' of value -1 (32-bit, signed) to type 'uint16_t' (aka 'unsigned short') changed the value to 65535 (16-bit, unsigned)
    #0 0x55b52fadbab7 in TmqhOutputPacketpool /artifacts/suricata/src/tmqh-packetpool.c:351:42
    #1 0x55b53008296f in PacketTunnelPktSetup /artifacts/suricata/src/decode.c:448:9
    #2 0x55b5312a1ba3 in DecodeGRE /artifacts/suricata/src/decode-gre.c:278:26
    #3 0x55b52ffbbc4a in DecodeIPV4 /artifacts/suricata/src/decode-ipv4.c:575:13
    #4 0x55b530082e2e in DecodeTunnel /artifacts/suricata/src/decode.c:193:20
    #5 0x55b5300826e8 in PacketTunnelPktSetup /artifacts/suricata/src/decode.c:439:11
    #6 0x55b5312a0b86 in DecodeGRE /artifacts/suricata/src/decode-gre.c:206:26
    #7 0x55b52ffbbc4a in DecodeIPV4 /artifacts/suricata/src/decode-ipv4.c:575:13
    #8 0x55b52ffb747a in DecodeNetworkLayer /artifacts/suricata/src/./decode.h:1502:13
    #9 0x55b52ffb67d1 in DecodeEthernet /artifacts/suricata/src/decode-ethernet.c:61:5
    #10 0x55b52fa851cb in DecodePcapFile /artifacts/suricata/src/source-pcap-file.c:470:9
    #11 0x55b52faad061 in TmThreadsSlotVarRun /artifacts/suricata/src/tm-threads.c:139:21
    #12 0x55b530cb5a5f in TmThreadsSlotProcessPkt /artifacts/suricata/src/./tm-threads.h:201:17
    #13 0x55b530ca8024 in PcapFileCallbackLoop /artifacts/suricata/src/source-pcap-file-helper.c:158:9
    #14 0x55b530ca4e25 in PcapFileDispatch /artifacts/suricata/src/source-pcap-file-helper.c:194:9
    #15 0x55b52fa8299e in ReceivePcapFileLoop /artifacts/suricata/src/source-pcap-file.c:220:18
    #16 0x55b52fa42c0b in LLVMFuzzerTestOneInput /artifacts/suricata/src/tests/fuzz/fuzz_decodepcapfile.c:100:9
    #17 0x55b52f93e3cb in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /usr/src/RPM/BUILD/llvm-project-20/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:619:13
    #18 0x55b52f92630f in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /usr/src/RPM/BUILD/llvm-project-20/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:328:6
    #19 0x55b52f92c4a1 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /usr/src/RPM/BUILD/llvm-project-20/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:863:9
    #20 0x55b52f958632 in main /usr/src/RPM/BUILD/llvm-project-20/compiler-rt/lib/fuzzer/FuzzerMain.cpp:20:10
    #21 0x7fd518b6ac8b  (/lib64/libc.so.6+0x27c8b) (BuildId: 169e9c77efa2e23950e429aa9b36a179832d8ae6)
    #22 0x7fd518b6ad44 in __libc_start_main (/lib64/libc.so.6+0x27d44) (BuildId: 169e9c77efa2e23950e429aa9b36a179832d8ae6)
    #23 0x55b52f920af0 in _start (/artifacts/debug_workdir/fuzz_decodepcapfile+0x14f9af0) (BuildId: c848abd25bb8485b160843c75178313353ee87ea)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior tmqh-packetpool.c:351:42

Here's full configuration options:

export CC=clang
export CXX=clang++
export 'RUSTFLAGS=-Cinstrument-coverage -Cdebuginfo=2 -Cforce-frame-pointers -Ccodegen-units=1 -Cpanic=abort -Copt-level=3'
export 'CFLAGS=-fprofile-instr-generate -fcoverage-mapping -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -gline-tables-only -O3 -fno-omit-frame-pointer -fsanitize=undefined -fsanitize=float-divide-by-zero -fsanitize=integer -fsanitize=implicit-conversion -fsanitize=local-bounds -fsanitize=nullability -fsanitize=vptr -fsanitize=address -fsanitize=alignment -g -O0'
export 'CXXFLAGS=-fprofile-instr-generate -fcoverage-mapping -DFUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION -gline-tables-only -O3 -fno-omit-frame-pointer -fsanitize=undefined -fsanitize=float-divide-by-zero -fsanitize=integer -fsanitize=implicit-conversion -fsanitize=local-bounds -fsanitize=nullability -fsanitize=vptr -fsanitize=address -fsanitize=alignment -g -O0'
export 'LDFLAGS= -fprofile-instr-generate -fcoverage-mapping'
./configure --enable-fuzztargets --enable-debug --enable-unittests --with-libpcre-includes=/usr/include/pcre --enable-gccprotect --enable-pie --disable-gccmarch-native --disable-coccinelle --enable-nfqueue --enable-nflog --enable-af-packet --enable-jansson --enable-geoip --enable-lua --enable-hiredis --enable-non-bundled-htp

Reproducing with
suricata --disable-detection -k none -c fuzz.yaml -r crash-ef6aaab27806c44e179464cc3cd35672aa381b86 with the supplied input