Suricata

Original report TL;DR

Suricata 8.0.6 accepts an NFSv3 READ reply with attr_follows=0, but the parser subsequently attempts to consume an 84-byte fattr3 structure unconditionally.
Under the NFSv3 XDR format, the attributes following the attr_follows discriminator are optional. When attr_follows=0, the 84-byte attribute structure is not present.
As a result, an otherwise valid NFSv3 READ success response is treated as malformed before its file content reaches Suricata’s file-data inspection path.