Detect count 5044 v4.8

[catenacyber]

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/5044

Describe changes:

• adds other modes to multi-buffers like all, all_or_absent, matches`, and precise indexing

SV_BRANCH=OISF/suricata-verify#3062

Draft : I would like some approval before doing all the individual modifications for each multi-buffer

#16103 with fix found by fuzz in CI

TODOs :

• add support for all multi-buf keywords
• add count support

[suricata-review-bot]

AI-generated review posted automatically by Suricata ai-review.

Verdict: request changes

• Medium — src/detect-engine.c:2413: Selector evaluation treats the 1,024-buffer inspection cap as end-of-list. Network-supplied additional Received headers are ignored, causing incorrect all, matches, precise-index, and oob_or results. Distinguish cap exhaustion from list completion and add boundary regressions beyond 1,024 entries.

• Medium — tests/detect-email-received-multi/test.rules:2 (suricata-verify PR Next/20171208/v5 #3062): Every selector test is a positive case that also alerts under ordinary “any buffer” behavior, so the suite passes even if selector semantics are ignored. Add negative assertions that distinguish all, match counts, precise indexes, absent lists, and out-of-bounds behavior from the default mode.

[codecov]

Codecov Report

❌ Patch coverage is 79.33884% with 50 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.02%. Comparing base (7c66954) to head (49071a0).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #16111      +/-   ##
==========================================
- Coverage   83.06%   83.02%   -0.04%     
==========================================
  Files        1004     1005       +1     
  Lines      277376   277587     +211     
==========================================
+ Hits       230389   230474      +85     
- Misses      46987    47113     +126     

Flag	Coverage Δ
fuzzcorpus	61.45% <28.75%> (-0.06%)	⬇️
livemode	18.42% <7.29%> (-0.01%)	⬇️
netns	22.83% <7.29%> (-0.06%)	⬇️
pcap	45.31% <14.59%> (-0.11%)	⬇️
suricata-verify	67.16% <77.68%> (+<0.01%)	⬆️
unittests	58.50% <23.14%> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[suricata-qa]

WARNING:

field	baseline	test	%
	SURI_TLPR1_stats_chk
.app_layer.flow.ftp_data	659	627	95.14%

Pipeline = 33335