Suricata

Hello Suricata maintainers,

I am reporting a stable behavior difference observed in a controlled, offline synthetic test, and asking whether this is expected. This is not a claim of a confirmed vulnerability.

Observation (SID 45012): changing only the direction gate did not produce an alert. The alert appeared only when the direction handling and file_data buffer activation were both adjusted. This suggests the result may depend on the interaction between rule direction and application-layer buffer activation. Could you confirm whether this behavior is expected, and whether a Suricata-Verify test would be appropriate?

Reproduction environment: isolated offline container, no network access; Suricata configuration at /etc/suricata/suricata.yaml. The attached ZIP contains the synthetic PCAP, rule/configuration, and reproduction notes. PCAP and rule hashes are recorded in the runtime request included in the package. Runtime image digest: sha256:9511823211682eaea97579a5e71a32ed41ac22431c7f437737fe6007171db2e3. The image itself is not included and may only be available locally.

The controlled experiment was performed on 2026-09-17. The ZIP was organized on 2026-10-25; it has not been independently replayed since packaging. No production systems or third-party targets were involved. This is for defensive, responsible reporting only.