Suricata

Hello Suricata maintainers,

I am reporting a repeatable detection-behavior difference from a local, offline NIDS study and asking whether this behavior is expected. This is not an assertion of a vulnerability or production impact.

Case / rule: fuzzing-results_os_repe3-RCA-000116; SID 18073. The frozen synthetic HTTP request contains the target literals `.asp?` and `ONMOUSEOVER=`. In the recorded transport, neither endpoint independently satisfies the rule header. Instrumentation directly recorded both source- and destination-address predicates as false; the baseline/transport control was neutral.

Controlled comparison: I ran the preregistered three-member comparison (both endpoint gates, source-only, destination-only). Only restoring both endpoint predicates changed the alert vector from 1/1/0 to 1/1/1; either endpoint alone did not restore the target alert. This supports an interaction in this specific case only, not a general claim about all endpoint rules.

Could you confirm whether this behavior is expected for this rule/configuration, and whether a regression test or documentation clarification would be useful?

Reproduction environment: local, offline synthetic NIDS testing only. No live network, production deployment, or third-party target was involved. The attached `issue-14.zip` contains the PCAP, case/rule data, replay configuration, and recorded environment identity. It was assembled from a prior recorded run and has not been independently replayed since staging. The report is a behavior question, not a confirmed vulnerability claim.

Thank you.