diff --git a/rust/src/detect/datasets.rs b/rust/src/detect/datasets.rs
index 2f4d968be200..2f37b554e1bb 100644
--- a/rust/src/detect/datasets.rs
+++ b/rust/src/detect/datasets.rs
@@ -19,6 +19,7 @@
 
 //! This module exposes items from the datasets C code to Rust.
 
+use crate::ffi::hashing::{SC_MD5_LEN, SC_SHA256_LEN};
 use base64::{self, Engine};
 use std::ffi::{c_char, CStr};
 use std::fs::{File, OpenOptions};
@@ -168,12 +169,15 @@ unsafe fn process_md5_set(
         Ok(rs) => rs,
         Err(_) => return -1,
     };
+    if md5_string.len() != SC_MD5_LEN {
+        return -1;
+    }
 
     if no_rep {
-        DatasetAdd(set, md5_string.as_ptr(), 16);
+        DatasetAdd(set, md5_string.as_ptr(), SC_MD5_LEN as u32);
     } else if let Ok(val) = v[1].to_string().parse::<u16>() {
         let rep: DataRepType = DataRepType { value: val };
-        DatasetAddwRep(set, md5_string.as_ptr(), 16, &rep);
+        DatasetAddwRep(set, md5_string.as_ptr(), SC_MD5_LEN as u32, &rep);
     } else {
         SCFatalErrorOnInit!(
             "invalid datarep value {} in {}",
@@ -192,12 +196,15 @@ unsafe fn process_sha256_set(
         Ok(rs) => rs,
         Err(_) => return -1,
     };
+    if sha256_string.len() != SC_SHA256_LEN {
+        return -1;
+    }
 
     if no_rep {
-        DatasetAdd(set, sha256_string.as_ptr(), 32);
+        DatasetAdd(set, sha256_string.as_ptr(), SC_SHA256_LEN as u32);
     } else if let Ok(val) = v[1].to_string().parse::<u16>() {
         let rep: DataRepType = DataRepType { value: val };
-        DatasetAddwRep(set, sha256_string.as_ptr(), 32, &rep);
+        DatasetAddwRep(set, sha256_string.as_ptr(), SC_SHA256_LEN as u32, &rep);
     } else {
         SCFatalErrorOnInit!(
             "invalid datarep value {} in {}",
diff --git a/rust/src/nfs/nfs3_records.rs b/rust/src/nfs/nfs3_records.rs
index 86a13fe5df8a..9d8c587f5b01 100644
--- a/rust/src/nfs/nfs3_records.rs
+++ b/rust/src/nfs/nfs3_records.rs
@@ -390,7 +390,8 @@ pub fn parse_nfs3_request_write(i: &[u8], complete: bool) -> IResult<&[u8], Nfs3
 pub fn parse_nfs3_reply_read(i: &[u8], complete: bool) -> IResult<&[u8], NfsReplyRead<'_>> {
     let (i, status) = be_u32(i)?;
     let (i, attr_follows) = verify(be_u32, |&v| v <= 1)(i)?;
-    let (i, attr_blob) = take(84_usize)(i)?; // fixed size?
+    let (i, attr_blob_opt) = cond(attr_follows == 1, take(84_usize))(i)?;
+    let attr_blob = attr_blob_opt.unwrap_or(&[]);
     let (i, count) = be_u32(i)?;
     let (i, eof) = verify(be_u32, |&v| v <= 1)(i)?;
     let (i, data_len) = verify(be_u32, |&v| v <= count)(i)?;
diff --git a/src/detect-engine-frame.c b/src/detect-engine-frame.c
index 0652c3c751aa..db08c6eca823 100644
--- a/src/detect-engine-frame.c
+++ b/src/detect-engine-frame.c
@@ -475,7 +475,9 @@ static int FrameStreamDataInspectFunc(
     // PrintRawDataFp(stdout, data, data_len);
     // PrintRawDataFp(stdout, data, MIN(64, data_len));
 #endif
-    DEBUG_VALIDATE_BUG_ON(fsd->frame->len > 0 && (int64_t)data_len > fsd->frame->len);
+    // Only assert if the engine does not have transforms that may grow the buffer
+    DEBUG_VALIDATE_BUG_ON(fsd->frame->len > 0 && (int64_t)data_len > fsd->frame->len &&
+                          engine->sm_list == engine->sm_list_base);
 
     const bool match = DetectEngineContentInspection(det_ctx->de_ctx, det_ctx, s, engine->smd, p,
             p->flow, data, data_len, data_offset, buffer->flags,