Suricata

SMTP's max-tx documents a limit on live transactions per flow, but SMTPTransactionCreate() gates on tx_cnt, a monotonic high-water mark never decremented when the engine frees completed transactions. The cap thus bounds lifetime envelopes per connection: with max-tx=16, once 17 txs are created, the 18th envelope's creation fails, the parser errors with APP_LAYER_ERROR, and app-layer parsing is disabled for the whole flow.

The example also shows a off by one: max-tx 16 should allow 16 txs, not 17.

The security implication is that beyond max-tx logging and detection will fail as the parser hits an error state. So it's observable. In IPS mode the session by default will drop.