Suricata

Under heavy thread oversubscription, a management thread can be descheduled for the whole lifetime of a short offline (pcap-file) run. The window is narrow: the thread enters the initial pause and then loses the CPU until shutdown has already started. Threads are created paused (THV_PAUSE) and the main thread unpauses them at post-init; a management thread that has not been scheduled yet spins in TmThreadsWaitForUnpause(). If the run finishes before that thread is scheduled again, the shutdown path sets THV_KILL while the thread is still in the initial pause. TmThreadsWaitForUnpause() then returned false, and the thread skipped its main loop entirely.

For the stats management thread this means no final StatsOutput() call: the last stats event is never written to eve.json, and the shutdown summary reports Alerts: 0 while all other output is correct. This makes the failure look like a stats accounting problem rather than a thread that never ran.

Reproduction: 32-way oversubscription of short offline runs, about 1 failure in 6400 runs, with the failure signature matching exactly (the final stats event is absent).

Impact: intermittent failures in suricata-verify tests that assert on the final stats, a misleading shutdown summary, and a silently missing final stats record in eve.json.