Suricata

Hello Suricata maintainers,

I am reporting a repeatable detection-behavior difference from a local, offline NIDS study and asking whether this behavior is expected. This is not an assertion of a vulnerability or production impact.

Case / rule: fuzzing-results_os_obf1-RCA-000106; SID 20258. The frozen synthetic request line is `GET javascript: HTTP/1.1`. Instrumentation recorded a raw URI length of 11 (first byte 106) and no normalized URI representation (normalized length -1). A separate predicate observation recorded both endpoint gates as false.

Controlled comparison: restoring the raw-URI representation together with the endpoint factors changed the alert vector from 1/1/0 to 1/1/1. The URI-only forced comparison remained 1/1/0. We did not run the complete 2^3 factorial design, so we are not claiming a globally minimal cause.

Could you confirm whether this representation/gating behavior is expected for this rule/configuration, and whether a regression test or documentation clarification would be useful?

Reproduction environment: local, offline synthetic NIDS testing only. No live network, production deployment, or third-party target was involved. The attached `issue-15.zip` contains the PCAP, case/rule data, replay configuration, and recorded environment identity. It was assembled from a prior recorded run and has not been independently replayed since staging. This is a behavior question, not a confirmed vulnerability claim.

Thank you.