Suricata

Hello Suricata maintainers,

I am reporting a repeatable detection-behavior difference from a local, offline NIDS study and asking whether this behavior is expected. This is not an assertion of a vulnerability or production impact.

Case / rule: synthetic cases SID 26764, 15332, 7866, 15338, and 15372, plus an earlier bound instance. Long-whitespace / complex PCRE subjects consume the matcher work budget; instrumentation recorded subject length and start offset. At the target PCRE2 call, the bound runtime returned -47 (MATCHLIMIT), rather than inferring the cause from a missing alert. Raising only the effective O/default-branch limit changed the result to a non-negative match and restored one alert, while pattern, subject, offset, depth, and preceding gates were unchanged. Three other predicted failures without exact return-code evidence remain unknown.

Could you confirm whether this PCRE2 work-limit behavior is expected for this input and configuration, and whether a regression test or documentation clarification would be appropriate? This is limited to the recorded local runtime and does not recommend increasing limits in production.

Reproduction environment: local offline synthetic NIDS testing only; no live network, production deployment, or third-party target. The attached ZIP contains the PCAP, case/rule data, replay configuration, and recorded environment identity. It was assembled from a prior recorded run and has not been independently replayed since staging.

Thank you.