Suricata

Hello Suricata maintainers,

I am reporting a repeatable detection-behavior difference from a controlled, local offline NIDS study and asking whether this behavior is expected. This is not an assertion of a vulnerability or production impact.

Case / rule: fuzzing-results_4_pass1-RCA-000043; SID 42935. The target file_data buffer is 64 bytes, while the rule's byte_test reads 4 bytes at offset 68. The baseline did not alert. A controlled comparison changed only the numeric read to an in-bounds position, preserving the predicate and preceding content conditions; the Suricata result changed from no alert to alert. With the out-of-bounds read unchanged, the behavior did not reproduce as an alert.

Could you confirm whether this is expected for this rule and configuration, and whether a Suricata-Verify test would be useful? This report is scoped to this frozen synthetic input and local engine configuration; it does not claim a product vulnerability or impact.

Reproduction environment: isolated offline container, network disabled; Suricata configuration at /etc/suricata/suricata.yaml. The attached ZIP contains the synthetic PCAP, Suricata rule/configuration, and reproduction notes. Runtime image digest: sha256:e1392bdcf160090d52425f439e8b8a64f6cdcb9a14f4ef59cff55cd4325f2dfb. PCAP SHA-256: 1642e474cad4b6e24bd0dc92d53d7d616cab58d5fa9df27b0212e679a27e4c7f; rules SHA-256: 09c2d93696a42f65fbeaeab5af8fe425d5d62ad6c3a273199dfb18c83f82f299. The runtime image is not included and may be available only locally.

The source experiment is from a prior recorded run; this package has not been independently replayed since staging. The test is offline-only. No live host, production deployment, or third-party target is involved.

Thank you.