diff --git a/src/Makefile.am b/src/Makefile.am
index 1d02693a0c..31975ed1f7 100755
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -120,6 +120,7 @@ noinst_HEADERS = \
 	detect-engine-address-ipv6.h \
 	detect-engine-alert.h \
 	detect-engine-analyzer.h \
+	detect-engine-buffer.h \
 	detect-engine-build.h \
 	detect-engine-content-inspection.h \
 	detect-engine-dcepayload.h \
@@ -709,6 +710,7 @@ libsuricata_c_a_SOURCES = \
 	detect-engine-alert.c \
 	detect-engine-analyzer.c \
 	detect-engine-build.c \
+	detect-engine-buffer.c \
 	detect-engine.c \
 	detect-engine-content-inspection.c \
 	detect-engine-dcepayload.c \
diff --git a/src/detect-bsize.c b/src/detect-bsize.c
index c007960a57..3933953cd2 100644
--- a/src/detect-bsize.c
+++ b/src/detect-bsize.c
@@ -30,6 +30,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-content.h"
 #include "detect-engine-uint.h"
 
diff --git a/src/detect-byte-extract.c b/src/detect-byte-extract.c
index d590183f9c..dc83020d2e 100644
--- a/src/detect-byte-extract.c
+++ b/src/detect-byte-extract.c
@@ -407,6 +407,8 @@ SigMatch *DetectByteExtractRetrieveSMVar(const char *arg, const Signature *s)
 
 #ifdef UNITTESTS
 
+#include "detect-engine-buffer.h"
+
 static int g_file_data_buffer_id = 0;
 static int g_http_uri_buffer_id = 0;
 
diff --git a/src/detect-bytejump.c b/src/detect-bytejump.c
index e04d8a7a94..668333fd0d 100644
--- a/src/detect-bytejump.c
+++ b/src/detect-bytejump.c
@@ -28,6 +28,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "app-layer.h"
 
 #include "detect-byte.h"
diff --git a/src/detect-bytemath.c b/src/detect-bytemath.c
index babbee8689..2a651567d9 100644
--- a/src/detect-bytemath.c
+++ b/src/detect-bytemath.c
@@ -35,6 +35,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-build.h"
diff --git a/src/detect-bytetest.c b/src/detect-bytetest.c
index e637c5999c..051523306e 100644
--- a/src/detect-bytetest.c
+++ b/src/detect-bytetest.c
@@ -28,6 +28,7 @@
 #include "decode.h"
 #include "detect.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-parse.h"
 #include "detect-engine-build.h"
 
diff --git a/src/detect-content.c b/src/detect-content.c
index 7e35c60770..3c6cab3347 100644
--- a/src/detect-content.c
+++ b/src/detect-content.c
@@ -30,6 +30,7 @@
 #include "detect-uricontent.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-build.h"
 #include "detect-engine-state.h"
 #include "detect-parse.h"
diff --git a/src/detect-datarep.c b/src/detect-datarep.c
index 325046786d..a5e3540701 100644
--- a/src/detect-datarep.c
+++ b/src/detect-datarep.c
@@ -32,6 +32,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 
diff --git a/src/detect-dataset.c b/src/detect-dataset.c
index 6aec3fde68..4efa2dce74 100644
--- a/src/detect-dataset.c
+++ b/src/detect-dataset.c
@@ -32,6 +32,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 
diff --git a/src/detect-dce-stub-data.c b/src/detect-dce-stub-data.c
index 9005806e9d..81d9ce8fb0 100644
--- a/src/detect-dce-stub-data.c
+++ b/src/detect-dce-stub-data.c
@@ -30,6 +30,7 @@
 #include "detect-parse.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-build.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
diff --git a/src/detect-dnp3.c b/src/detect-dnp3.c
index de4edbbadf..cde1560b16 100644
--- a/src/detect-dnp3.c
+++ b/src/detect-dnp3.c
@@ -23,6 +23,7 @@
 #include "detect-parse.h"
 #include "detect-dnp3.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-dns-name.c b/src/detect-dns-name.c
index 24c30ee513..83e045c95d 100644
--- a/src/detect-dns-name.c
+++ b/src/detect-dns-name.c
@@ -28,6 +28,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-engine-helper.h"
 #include "detect-dns-name.h"
diff --git a/src/detect-dns-response.c b/src/detect-dns-response.c
index 9df17e4937..121a003119 100644
--- a/src/detect-dns-response.c
+++ b/src/detect-dns-response.c
@@ -24,6 +24,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-dns-response.h"
diff --git a/src/detect-email.c b/src/detect-email.c
index 4f35bb2660..9e64e1d4d2 100644
--- a/src/detect-email.c
+++ b/src/detect-email.c
@@ -16,6 +16,7 @@
  */
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-helper.h"
 #include "detect-parse.h"
 #include "app-layer-smtp.h"
diff --git a/src/detect-engine-buffer.c b/src/detect-engine-buffer.c
new file mode 100644
index 0000000000..4cb359b783
--- /dev/null
+++ b/src/detect-engine-buffer.c
@@ -0,0 +1,176 @@
+/* Copyright (C) 2025 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Victor Julien <victor@inliniac.net>
+ */
+
+#include "suricata-common.h"
+#include "detect-engine.h"
+#include "detect-parse.h"
+#include "detect-engine-buffer.h"
+
+int DetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
+{
+    BUG_ON(s->init_data == NULL);
+
+    if (s->init_data->list == DETECT_SM_LIST_BASE64_DATA) {
+        SCLogError("Rule buffer cannot be reset after base64_data.");
+        return -1;
+    }
+
+    if (s->init_data->list && s->init_data->transforms.cnt) {
+        SCLogError("no matches following transform(s)");
+        return -1;
+    }
+    s->init_data->list = list;
+    s->init_data->list_set = true;
+
+    // check if last has matches -> if no, error
+    if (s->init_data->curbuf && s->init_data->curbuf->head == NULL) {
+        SCLogError("previous sticky buffer has no matches");
+        return -1;
+    }
+
+    for (uint32_t x = 0; x < s->init_data->buffers_size; x++) {
+        SignatureInitDataBuffer *b = &s->init_data->buffers[x];
+        for (SigMatch *sm = b->head; sm != NULL; sm = sm->next) {
+            SCLogDebug(
+                    "buf:%p: id:%u: '%s' pos %u", b, b->id, sigmatch_table[sm->type].name, sm->idx);
+        }
+        if ((uint32_t)list == b->id) {
+            SCLogDebug("found buffer %p for list %d", b, list);
+            if (s->init_data->buffers[x].sm_init) {
+                s->init_data->buffers[x].sm_init = false;
+                SCLogDebug("sm_init was true for %p list %d", b, list);
+                s->init_data->curbuf = b;
+                return 0;
+
+            } else if (DetectEngineBufferTypeSupportsMultiInstanceGetById(de_ctx, list)) {
+                // fall through
+            } else if (!b->only_ts && (s->init_data->init_flags & SIG_FLAG_INIT_FORCE_TOSERVER)) {
+                // fall through
+            } else if (!b->only_tc && (s->init_data->init_flags & SIG_FLAG_INIT_FORCE_TOCLIENT)) {
+                // fall through
+            } else {
+                // we create a new buffer for the same id but forced different direction
+                SCLogWarning("duplicate instance for %s in '%s'",
+                        DetectEngineBufferTypeGetNameById(de_ctx, list), s->sig_str);
+                s->init_data->curbuf = b;
+                return 0;
+            }
+        }
+    }
+
+    if (list < DETECT_SM_LIST_MAX)
+        return 0;
+
+    if (SignatureInitDataBufferCheckExpand(s) < 0) {
+        SCLogError("failed to expand rule buffer array");
+        return -1;
+    }
+
+    /* initialize new buffer */
+    s->init_data->curbuf = &s->init_data->buffers[s->init_data->buffer_index++];
+    s->init_data->curbuf->id = list;
+    s->init_data->curbuf->head = NULL;
+    s->init_data->curbuf->tail = NULL;
+    s->init_data->curbuf->multi_capable =
+            DetectEngineBufferTypeSupportsMultiInstanceGetById(de_ctx, list);
+    if (s->init_data->init_flags & SIG_FLAG_INIT_FORCE_TOCLIENT) {
+        s->init_data->curbuf->only_tc = true;
+    }
+    if (s->init_data->init_flags & SIG_FLAG_INIT_FORCE_TOSERVER) {
+        s->init_data->curbuf->only_ts = true;
+    }
+
+    SCLogDebug("new: idx %u list %d set up curbuf %p", s->init_data->buffer_index - 1, list,
+            s->init_data->curbuf);
+
+    return 0;
+}
+
+int DetectBufferGetActiveList(DetectEngineCtx *de_ctx, Signature *s)
+{
+    BUG_ON(s->init_data == NULL);
+
+    if (s->init_data->list && s->init_data->transforms.cnt) {
+        if (s->init_data->list == DETECT_SM_LIST_NOTSET ||
+                s->init_data->list < DETECT_SM_LIST_DYNAMIC_START) {
+            SCLogError("previous transforms not consumed "
+                       "(list: %u, transform_cnt %u)",
+                    s->init_data->list, s->init_data->transforms.cnt);
+            SCReturnInt(-1);
+        }
+
+        SCLogDebug("buffer %d has transform(s) registered: %d", s->init_data->list,
+                s->init_data->transforms.cnt);
+        int new_list = DetectEngineBufferTypeGetByIdTransforms(de_ctx, s->init_data->list,
+                s->init_data->transforms.transforms, s->init_data->transforms.cnt);
+        if (new_list == -1) {
+            SCReturnInt(-1);
+        }
+        int base_list = s->init_data->list;
+        SCLogDebug("new_list %d", new_list);
+        s->init_data->list = new_list;
+        s->init_data->list_set = false;
+        // reset transforms now that we've set up the list
+        s->init_data->transforms.cnt = 0;
+
+        if (s->init_data->curbuf && s->init_data->curbuf->head != NULL) {
+            if (SignatureInitDataBufferCheckExpand(s) < 0) {
+                SCLogError("failed to expand rule buffer array");
+                return -1;
+            }
+            s->init_data->curbuf = &s->init_data->buffers[s->init_data->buffer_index++];
+            s->init_data->curbuf->multi_capable =
+                    DetectEngineBufferTypeSupportsMultiInstanceGetById(de_ctx, base_list);
+        }
+        if (s->init_data->curbuf == NULL) {
+            SCLogError("failed to setup buffer");
+            DEBUG_VALIDATE_BUG_ON(1);
+            SCReturnInt(-1);
+        }
+        s->init_data->curbuf->id = new_list;
+        SCLogDebug("new list after applying transforms: %u", new_list);
+    }
+
+    SCReturnInt(0);
+}
+
+SigMatch *DetectBufferGetFirstSigMatch(const Signature *s, const uint32_t buf_id)
+{
+    for (uint32_t i = 0; i < s->init_data->buffer_index; i++) {
+        if (buf_id == s->init_data->buffers[i].id) {
+            return s->init_data->buffers[i].head;
+        }
+    }
+    return NULL;
+}
+
+SigMatch *DetectBufferGetLastSigMatch(const Signature *s, const uint32_t buf_id)
+{
+    SigMatch *last = NULL;
+    for (uint32_t i = 0; i < s->init_data->buffer_index; i++) {
+        if (buf_id == s->init_data->buffers[i].id) {
+            last = s->init_data->buffers[i].tail;
+        }
+    }
+    return last;
+}
diff --git a/src/detect-engine-buffer.h b/src/detect-engine-buffer.h
new file mode 100644
index 0000000000..5031ee4958
--- /dev/null
+++ b/src/detect-engine-buffer.h
@@ -0,0 +1,34 @@
+/* Copyright (C) 2025 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+/**
+ * \file
+ *
+ * \author Victor Julien <victor@inliniac.net>
+ */
+
+#ifndef SURICATA_DETECT_ENGINE_BUFFER_H
+#define SURICATA_DETECT_ENGINE_BUFFER_H
+
+#include "detect.h"
+
+int WARN_UNUSED DetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list);
+int DetectBufferGetActiveList(DetectEngineCtx *de_ctx, Signature *s);
+SigMatch *DetectBufferGetFirstSigMatch(const Signature *s, const uint32_t buf_id);
+SigMatch *DetectBufferGetLastSigMatch(const Signature *s, const uint32_t buf_id);
+
+#endif /* SURICATA_DETECT_ENGINE_BUFFER_H */
diff --git a/src/detect-engine.c b/src/detect-engine.c
index f6fed8a495..d1c6a2b2ad 100644
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -1388,27 +1388,6 @@ bool DetectEngineBufferRunValidateCallback(
     return true;
 }
 
-SigMatch *DetectBufferGetFirstSigMatch(const Signature *s, const uint32_t buf_id)
-{
-    for (uint32_t i = 0; i < s->init_data->buffer_index; i++) {
-        if (buf_id == s->init_data->buffers[i].id) {
-            return s->init_data->buffers[i].head;
-        }
-    }
-    return NULL;
-}
-
-SigMatch *DetectBufferGetLastSigMatch(const Signature *s, const uint32_t buf_id)
-{
-    SigMatch *last = NULL;
-    for (uint32_t i = 0; i < s->init_data->buffer_index; i++) {
-        if (buf_id == s->init_data->buffers[i].id) {
-            last = s->init_data->buffers[i].tail;
-        }
-    }
-    return last;
-}
-
 bool DetectBufferIsPresent(const Signature *s, const uint32_t buf_id)
 {
     for (uint32_t i = 0; i < s->init_data->buffer_index; i++) {
@@ -1419,134 +1398,6 @@ bool DetectBufferIsPresent(const Signature *s, const uint32_t buf_id)
     return false;
 }
 
-int DetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list)
-{
-    BUG_ON(s->init_data == NULL);
-
-    if (s->init_data->list == DETECT_SM_LIST_BASE64_DATA) {
-        SCLogError("Rule buffer cannot be reset after base64_data.");
-        return -1;
-    }
-
-    if (s->init_data->list && s->init_data->transforms.cnt) {
-        SCLogError("no matches following transform(s)");
-        return -1;
-    }
-    s->init_data->list = list;
-    s->init_data->list_set = true;
-
-    // check if last has matches -> if no, error
-    if (s->init_data->curbuf && s->init_data->curbuf->head == NULL) {
-        SCLogError("previous sticky buffer has no matches");
-        return -1;
-    }
-
-    for (uint32_t x = 0; x < s->init_data->buffers_size; x++) {
-        SignatureInitDataBuffer *b = &s->init_data->buffers[x];
-        for (SigMatch *sm = b->head; sm != NULL; sm = sm->next) {
-            SCLogDebug(
-                    "buf:%p: id:%u: '%s' pos %u", b, b->id, sigmatch_table[sm->type].name, sm->idx);
-        }
-        if ((uint32_t)list == b->id) {
-            SCLogDebug("found buffer %p for list %d", b, list);
-            if (s->init_data->buffers[x].sm_init) {
-                s->init_data->buffers[x].sm_init = false;
-                SCLogDebug("sm_init was true for %p list %d", b, list);
-                s->init_data->curbuf = b;
-                return 0;
-
-            } else if (DetectEngineBufferTypeSupportsMultiInstanceGetById(de_ctx, list)) {
-                // fall through
-            } else if (!b->only_ts && (s->init_data->init_flags & SIG_FLAG_INIT_FORCE_TOSERVER)) {
-                // fall through
-            } else if (!b->only_tc && (s->init_data->init_flags & SIG_FLAG_INIT_FORCE_TOCLIENT)) {
-                // fall through
-            } else {
-                // we create a new buffer for the same id but forced different direction
-                SCLogWarning("duplicate instance for %s in '%s'",
-                        DetectEngineBufferTypeGetNameById(de_ctx, list), s->sig_str);
-                s->init_data->curbuf = b;
-                return 0;
-            }
-        }
-    }
-
-    if (list < DETECT_SM_LIST_MAX)
-        return 0;
-
-    if (SignatureInitDataBufferCheckExpand(s) < 0) {
-        SCLogError("failed to expand rule buffer array");
-        return -1;
-    }
-
-    /* initialize new buffer */
-    s->init_data->curbuf = &s->init_data->buffers[s->init_data->buffer_index++];
-    s->init_data->curbuf->id = list;
-    s->init_data->curbuf->head = NULL;
-    s->init_data->curbuf->tail = NULL;
-    s->init_data->curbuf->multi_capable =
-            DetectEngineBufferTypeSupportsMultiInstanceGetById(de_ctx, list);
-    if (s->init_data->init_flags & SIG_FLAG_INIT_FORCE_TOCLIENT) {
-        s->init_data->curbuf->only_tc = true;
-    }
-    if (s->init_data->init_flags & SIG_FLAG_INIT_FORCE_TOSERVER) {
-        s->init_data->curbuf->only_ts = true;
-    }
-
-    SCLogDebug("new: idx %u list %d set up curbuf %p", s->init_data->buffer_index - 1, list,
-            s->init_data->curbuf);
-
-    return 0;
-}
-
-int DetectBufferGetActiveList(DetectEngineCtx *de_ctx, Signature *s)
-{
-    BUG_ON(s->init_data == NULL);
-
-    if (s->init_data->list && s->init_data->transforms.cnt) {
-        if (s->init_data->list == DETECT_SM_LIST_NOTSET ||
-            s->init_data->list < DETECT_SM_LIST_DYNAMIC_START) {
-            SCLogError("previous transforms not consumed "
-                       "(list: %u, transform_cnt %u)",
-                    s->init_data->list, s->init_data->transforms.cnt);
-            SCReturnInt(-1);
-        }
-
-        SCLogDebug("buffer %d has transform(s) registered: %d",
-                s->init_data->list, s->init_data->transforms.cnt);
-        int new_list = DetectEngineBufferTypeGetByIdTransforms(de_ctx, s->init_data->list,
-                s->init_data->transforms.transforms, s->init_data->transforms.cnt);
-        if (new_list == -1) {
-            SCReturnInt(-1);
-        }
-        int base_list = s->init_data->list;
-        SCLogDebug("new_list %d", new_list);
-        s->init_data->list = new_list;
-        s->init_data->list_set = false;
-        // reset transforms now that we've set up the list
-        s->init_data->transforms.cnt = 0;
-
-        if (s->init_data->curbuf && s->init_data->curbuf->head != NULL) {
-            if (SignatureInitDataBufferCheckExpand(s) < 0) {
-                SCLogError("failed to expand rule buffer array");
-                return -1;
-            }
-            s->init_data->curbuf = &s->init_data->buffers[s->init_data->buffer_index++];
-            s->init_data->curbuf->multi_capable =
-                    DetectEngineBufferTypeSupportsMultiInstanceGetById(de_ctx, base_list);
-        }
-        if (s->init_data->curbuf == NULL) {
-            SCLogError("failed to setup buffer");
-            DEBUG_VALIDATE_BUG_ON(1);
-            SCReturnInt(-1);
-        }
-        s->init_data->curbuf->id = new_list;
-        SCLogDebug("new list after applying transforms: %u", new_list);
-    }
-
-    SCReturnInt(0);
-}
-
 void InspectionBufferClean(DetectEngineThreadCtx *det_ctx)
 {
     /* single buffers */
diff --git a/src/detect-engine.h b/src/detect-engine.h
index cc6e55b526..f033c632ad 100644
--- a/src/detect-engine.h
+++ b/src/detect-engine.h
@@ -201,11 +201,6 @@ int DetectEngineMustParseMetadata(void);
 
 bool DetectBufferIsPresent(const Signature *s, const uint32_t buf_id);
 
-int WARN_UNUSED DetectBufferSetActiveList(DetectEngineCtx *de_ctx, Signature *s, const int list);
-int DetectBufferGetActiveList(DetectEngineCtx *de_ctx, Signature *s);
-SigMatch *DetectBufferGetFirstSigMatch(const Signature *s, const uint32_t buf_id);
-SigMatch *DetectBufferGetLastSigMatch(const Signature *s, const uint32_t buf_id);
-
 DetectEngineThreadCtx *DetectEngineThreadCtxInitForReload(
         ThreadVars *tv, DetectEngineCtx *new_de_ctx, int mt);
 
diff --git a/src/detect-entropy.c b/src/detect-entropy.c
index 31a1ac8481..48e88f9fbd 100644
--- a/src/detect-entropy.c
+++ b/src/detect-entropy.c
@@ -20,6 +20,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 
 #include "detect-entropy.h"
 
diff --git a/src/detect-fast-pattern.c b/src/detect-fast-pattern.c
index 1a7a617f50..19fdeba98a 100644
--- a/src/detect-fast-pattern.c
+++ b/src/detect-fast-pattern.c
@@ -382,6 +382,7 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, const c
 
 #ifdef UNITTESTS
 #include "detect-engine-alert.h"
+#include "detect-engine-buffer.h"
 static SigMatch *GetMatches(Signature *s, const int list)
 {
     SigMatch *sm = DetectBufferGetFirstSigMatch(s, list);
diff --git a/src/detect-file-data.c b/src/detect-file-data.c
index f1e17c8535..011b4c4f78 100644
--- a/src/detect-file-data.c
+++ b/src/detect-file-data.c
@@ -30,6 +30,7 @@
 #include "detect-parse.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index 77966ebd99..316320ba13 100644
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -31,6 +31,7 @@
 #include "detect-content.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-filename.c b/src/detect-filename.c
index 65e0151e8b..df9ba98d0c 100644
--- a/src/detect-filename.c
+++ b/src/detect-filename.c
@@ -30,6 +30,7 @@
 #include "detect.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-file.h"
diff --git a/src/detect-frame.c b/src/detect-frame.c
index d2f7461f75..7e93b70267 100644
--- a/src/detect-frame.c
+++ b/src/detect-frame.c
@@ -29,6 +29,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-ftp-command-data.c b/src/detect-ftp-command-data.c
index 4bed3d7a40..54553ce8f6 100644
--- a/src/detect-ftp-command-data.c
+++ b/src/detect-ftp-command-data.c
@@ -28,6 +28,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-helper.h"
diff --git a/src/detect-ftp-command.c b/src/detect-ftp-command.c
index f06e46cccb..521d0671f7 100644
--- a/src/detect-ftp-command.c
+++ b/src/detect-ftp-command.c
@@ -28,6 +28,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-ftp-reply.c b/src/detect-ftp-reply.c
index 2c51e3b5f8..1fd7a9a463 100644
--- a/src/detect-ftp-reply.c
+++ b/src/detect-ftp-reply.c
@@ -28,6 +28,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-helper.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-ftp-reply.h"
diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c
index 35f8b976e9..00ed170ee5 100644
--- a/src/detect-http-client-body.c
+++ b/src/detect-http-client-body.c
@@ -37,6 +37,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c
index c6532b92c4..f56c28567b 100644
--- a/src/detect-http-cookie.c
+++ b/src/detect-http-cookie.c
@@ -37,6 +37,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-http-header-names.c b/src/detect-http-header-names.c
index c748c70f1c..3eb5406e41 100644
--- a/src/detect-http-header-names.c
+++ b/src/detect-http-header-names.c
@@ -37,6 +37,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-http-header.c b/src/detect-http-header.c
index 938a9049d7..3efcc16f10 100644
--- a/src/detect-http-header.c
+++ b/src/detect-http-header.c
@@ -37,6 +37,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-http-headers-stub.h b/src/detect-http-headers-stub.h
index 529dca5ad5..2dafa0d82b 100644
--- a/src/detect-http-headers-stub.h
+++ b/src/detect-http-headers-stub.h
@@ -34,6 +34,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 
diff --git a/src/detect-http-host.c b/src/detect-http-host.c
index 89a7708931..4f107945e4 100644
--- a/src/detect-http-host.c
+++ b/src/detect-http-host.c
@@ -37,6 +37,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-http-method.c b/src/detect-http-method.c
index 74eb7977c8..52e10138c7 100644
--- a/src/detect-http-method.c
+++ b/src/detect-http-method.c
@@ -37,6 +37,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-http-protocol.c b/src/detect-http-protocol.c
index d7c28bfb29..56eb2e2a53 100644
--- a/src/detect-http-protocol.c
+++ b/src/detect-http-protocol.c
@@ -37,6 +37,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-http-raw-header.c b/src/detect-http-raw-header.c
index 0b4adef6fa..5f6e38b6fe 100644
--- a/src/detect-http-raw-header.c
+++ b/src/detect-http-raw-header.c
@@ -37,6 +37,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-http-request-line.c b/src/detect-http-request-line.c
index 768d28f6ca..2edd79aef1 100644
--- a/src/detect-http-request-line.c
+++ b/src/detect-http-request-line.c
@@ -37,6 +37,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-http-response-line.c b/src/detect-http-response-line.c
index 6eb86445fd..72a5eda92d 100644
--- a/src/detect-http-response-line.c
+++ b/src/detect-http-response-line.c
@@ -37,6 +37,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-http-server-body.c b/src/detect-http-server-body.c
index 6ef4594ec9..6cdb639944 100644
--- a/src/detect-http-server-body.c
+++ b/src/detect-http-server-body.c
@@ -38,6 +38,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-content.h"
 
diff --git a/src/detect-http-start.c b/src/detect-http-start.c
index 4a61010562..85d9a493de 100644
--- a/src/detect-http-start.c
+++ b/src/detect-http-start.c
@@ -36,6 +36,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-http-stat-code.c b/src/detect-http-stat-code.c
index 8ffddc74f5..646bb8d19a 100644
--- a/src/detect-http-stat-code.c
+++ b/src/detect-http-stat-code.c
@@ -38,6 +38,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-http-stat-msg.c b/src/detect-http-stat-msg.c
index 93640df97e..8f3ba31280 100644
--- a/src/detect-http-stat-msg.c
+++ b/src/detect-http-stat-msg.c
@@ -38,6 +38,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-http-ua.c b/src/detect-http-ua.c
index 90f31c4a1e..0a3a544be2 100644
--- a/src/detect-http-ua.c
+++ b/src/detect-http-ua.c
@@ -37,6 +37,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c
index 0d9c03adf9..d90ca641ec 100644
--- a/src/detect-http-uri.c
+++ b/src/detect-http-uri.c
@@ -36,6 +36,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-http2.c b/src/detect-http2.c
index aea75be824..28585dc86d 100644
--- a/src/detect-http2.c
+++ b/src/detect-http2.c
@@ -29,6 +29,7 @@
 #include "detect-content.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-uint.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-icmpv4hdr.c b/src/detect-icmpv4hdr.c
index 43a8849915..c70d88f911 100644
--- a/src/detect-icmpv4hdr.c
+++ b/src/detect-icmpv4hdr.c
@@ -26,6 +26,7 @@
 
 #include "detect.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-icmpv4hdr.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-icmpv6hdr.c b/src/detect-icmpv6hdr.c
index 0bd9b2b4fc..31331328c1 100644
--- a/src/detect-icmpv6hdr.c
+++ b/src/detect-icmpv6hdr.c
@@ -27,6 +27,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-ike-key-exchange-payload.c b/src/detect-ike-key-exchange-payload.c
index fadad07f28..6de0180dd9 100644
--- a/src/detect-ike-key-exchange-payload.c
+++ b/src/detect-ike-key-exchange-payload.c
@@ -27,6 +27,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-urilen.h"
diff --git a/src/detect-ike-nonce-payload.c b/src/detect-ike-nonce-payload.c
index 20c28585dd..5de3dbc27e 100644
--- a/src/detect-ike-nonce-payload.c
+++ b/src/detect-ike-nonce-payload.c
@@ -27,6 +27,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-urilen.h"
diff --git a/src/detect-ike-spi.c b/src/detect-ike-spi.c
index 52bc97b068..9f1311c85b 100644
--- a/src/detect-ike-spi.c
+++ b/src/detect-ike-spi.c
@@ -27,6 +27,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-urilen.h"
diff --git a/src/detect-ike-vendor.c b/src/detect-ike-vendor.c
index 6042461dd3..0097b37a9c 100644
--- a/src/detect-ike-vendor.c
+++ b/src/detect-ike-vendor.c
@@ -25,6 +25,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-engine-mpm.h"
diff --git a/src/detect-ipv4hdr.c b/src/detect-ipv4hdr.c
index 1db2bf0f28..a9a5ed1baa 100644
--- a/src/detect-ipv4hdr.c
+++ b/src/detect-ipv4hdr.c
@@ -27,6 +27,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-ipv6hdr.c b/src/detect-ipv6hdr.c
index 28a61023e2..32c7f3cc71 100644
--- a/src/detect-ipv6hdr.c
+++ b/src/detect-ipv6hdr.c
@@ -27,6 +27,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-isdataat.c b/src/detect-isdataat.c
index 6bc4e961c0..8187043308 100644
--- a/src/detect-isdataat.c
+++ b/src/detect-isdataat.c
@@ -27,6 +27,7 @@
 #include "decode.h"
 #include "detect.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-parse.h"
 #include "app-layer.h"
 
diff --git a/src/detect-ja4-hash.c b/src/detect-ja4-hash.c
index 645c6eba54..5e08e7a093 100644
--- a/src/detect-ja4-hash.c
+++ b/src/detect-ja4-hash.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-ja4-hash.h"
diff --git a/src/detect-krb5-cname.c b/src/detect-krb5-cname.c
index dbd828669b..647bf9f1d8 100644
--- a/src/detect-krb5-cname.c
+++ b/src/detect-krb5-cname.c
@@ -26,6 +26,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-krb5-sname.c b/src/detect-krb5-sname.c
index a806803fb3..9510f493f8 100644
--- a/src/detect-krb5-sname.c
+++ b/src/detect-krb5-sname.c
@@ -26,6 +26,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-lua.c b/src/detect-lua.c
index 9137afeba1..2854ae5cec 100644
--- a/src/detect-lua.c
+++ b/src/detect-lua.c
@@ -31,6 +31,7 @@
 #include "detect-parse.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-build.h"
 
diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index 435ffc0628..e46ffc21ad 100644
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -37,6 +37,7 @@
 #include "detect-parse.h"
 #include "detect-content.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-sigorder.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
diff --git a/src/detect-quic-cyu-hash.c b/src/detect-quic-cyu-hash.c
index 2cb9a31740..86ec9559a7 100644
--- a/src/detect-quic-cyu-hash.c
+++ b/src/detect-quic-cyu-hash.c
@@ -26,6 +26,7 @@
 #include "detect-content.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-quic-cyu-string.c b/src/detect-quic-cyu-string.c
index 6dbb45684f..514abb9646 100644
--- a/src/detect-quic-cyu-string.c
+++ b/src/detect-quic-cyu-string.c
@@ -24,6 +24,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-quic-sni.c b/src/detect-quic-sni.c
index 5f5142727c..0623d0f59c 100644
--- a/src/detect-quic-sni.c
+++ b/src/detect-quic-sni.c
@@ -25,6 +25,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-quic-ua.c b/src/detect-quic-ua.c
index 732d79dbac..a32a46cdfb 100644
--- a/src/detect-quic-ua.c
+++ b/src/detect-quic-ua.c
@@ -25,6 +25,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-quic-version.c b/src/detect-quic-version.c
index 2d40becf3d..f06a22dda3 100644
--- a/src/detect-quic-version.c
+++ b/src/detect-quic-version.c
@@ -25,6 +25,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-sip-method.c b/src/detect-sip-method.c
index 2c0eeeee48..f99b303d9f 100644
--- a/src/detect-sip-method.c
+++ b/src/detect-sip-method.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-sip-uri.c b/src/detect-sip-uri.c
index cd78cd12c5..cd0b00ae83 100644
--- a/src/detect-sip-uri.c
+++ b/src/detect-sip-uri.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-smb-ntlmssp.c b/src/detect-smb-ntlmssp.c
index 644704400e..9a59d5bda9 100644
--- a/src/detect-smb-ntlmssp.c
+++ b/src/detect-smb-ntlmssp.c
@@ -29,6 +29,7 @@
 #include "detect-parse.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-smb-share.c b/src/detect-smb-share.c
index 22a3e72f99..d81b3473cc 100644
--- a/src/detect-smb-share.c
+++ b/src/detect-smb-share.c
@@ -28,6 +28,7 @@
 #include "detect-parse.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-smtp.c b/src/detect-smtp.c
index 1a5aa03b42..724b36d128 100644
--- a/src/detect-smtp.c
+++ b/src/detect-smtp.c
@@ -25,6 +25,7 @@
 #include "suricata-common.h"
 #include "detect-smtp.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-content-inspection.h"
 #include "detect-engine-helper.h"
 #include "detect-parse.h"
diff --git a/src/detect-ssh-hassh-server-string.c b/src/detect-ssh-hassh-server-string.c
index 287846a886..b84687bfe3 100644
--- a/src/detect-ssh-hassh-server-string.c
+++ b/src/detect-ssh-hassh-server-string.c
@@ -29,6 +29,7 @@
 #include "detect-parse.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-ssh-hassh-server.c b/src/detect-ssh-hassh-server.c
index 448aa1b2a6..719473ad29 100644
--- a/src/detect-ssh-hassh-server.c
+++ b/src/detect-ssh-hassh-server.c
@@ -30,6 +30,7 @@
 #include "detect-content.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-ssh-hassh-string.c b/src/detect-ssh-hassh-string.c
index f55c20d9f4..c177e33180 100644
--- a/src/detect-ssh-hassh-string.c
+++ b/src/detect-ssh-hassh-string.c
@@ -29,6 +29,7 @@
 #include "detect-parse.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-ssh-hassh.c b/src/detect-ssh-hassh.c
index e3593b9073..04b8f4b3c9 100644
--- a/src/detect-ssh-hassh.c
+++ b/src/detect-ssh-hassh.c
@@ -30,6 +30,7 @@
 #include "detect-content.h"
 
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-ssh-proto.c b/src/detect-ssh-proto.c
index b25e57db8d..48b5b23b80 100644
--- a/src/detect-ssh-proto.c
+++ b/src/detect-ssh-proto.c
@@ -37,6 +37,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-ssh-software.c b/src/detect-ssh-software.c
index c0d36c06f2..77d70af1a5 100644
--- a/src/detect-ssh-software.c
+++ b/src/detect-ssh-software.c
@@ -37,6 +37,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-state.h"
 #include "detect-engine-prefilter.h"
diff --git a/src/detect-tcphdr.c b/src/detect-tcphdr.c
index 920bdd798b..aba3f871ae 100644
--- a/src/detect-tcphdr.c
+++ b/src/detect-tcphdr.c
@@ -27,6 +27,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-tls-alpn.c b/src/detect-tls-alpn.c
index dfa6fb4408..8f7563cf4d 100644
--- a/src/detect-tls-alpn.c
+++ b/src/detect-tls-alpn.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-tls-cert-fingerprint.c b/src/detect-tls-cert-fingerprint.c
index 3500c5f90a..c01887fade 100644
--- a/src/detect-tls-cert-fingerprint.c
+++ b/src/detect-tls-cert-fingerprint.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-tls-cert-issuer.c b/src/detect-tls-cert-issuer.c
index 340abf2fab..fd3d4aa924 100644
--- a/src/detect-tls-cert-issuer.c
+++ b/src/detect-tls-cert-issuer.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-tls-cert-serial.c b/src/detect-tls-cert-serial.c
index f022170427..1df78297b6 100644
--- a/src/detect-tls-cert-serial.c
+++ b/src/detect-tls-cert-serial.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-tls-cert-subject.c b/src/detect-tls-cert-subject.c
index 55dc976e24..96e50006d4 100644
--- a/src/detect-tls-cert-subject.c
+++ b/src/detect-tls-cert-subject.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-tls-certs.c b/src/detect-tls-certs.c
index 197ce42bdf..aa8a86318f 100644
--- a/src/detect-tls-certs.c
+++ b/src/detect-tls-certs.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-tls-ja3-hash.c b/src/detect-tls-ja3-hash.c
index f4d7154d03..2b412c3e96 100644
--- a/src/detect-tls-ja3-hash.c
+++ b/src/detect-tls-ja3-hash.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-tls-ja3-string.c b/src/detect-tls-ja3-string.c
index 81b44c42fc..a831ad46bc 100644
--- a/src/detect-tls-ja3-string.c
+++ b/src/detect-tls-ja3-string.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-tls-ja3s-hash.c b/src/detect-tls-ja3s-hash.c
index 2bec725169..48397b1cd3 100644
--- a/src/detect-tls-ja3s-hash.c
+++ b/src/detect-tls-ja3s-hash.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-tls-ja3s-string.c b/src/detect-tls-ja3s-string.c
index 857e045f7d..ba8f7bda18 100644
--- a/src/detect-tls-ja3s-string.c
+++ b/src/detect-tls-ja3s-string.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-content.h"
diff --git a/src/detect-tls-random.c b/src/detect-tls-random.c
index 76e6049069..abc850cd0f 100644
--- a/src/detect-tls-random.c
+++ b/src/detect-tls-random.c
@@ -21,6 +21,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-content.h"
 
diff --git a/src/detect-tls-sni.c b/src/detect-tls-sni.c
index 7905e67c59..73cc630723 100644
--- a/src/detect-tls-sni.c
+++ b/src/detect-tls-sni.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-content.h"
 #include "detect-pcre.h"
diff --git a/src/detect-tls-subjectaltname.c b/src/detect-tls-subjectaltname.c
index ef0aafc3aa..7bb601c850 100644
--- a/src/detect-tls-subjectaltname.c
+++ b/src/detect-tls-subjectaltname.c
@@ -30,6 +30,7 @@
 
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"
diff --git a/src/detect-udphdr.c b/src/detect-udphdr.c
index 0e604104a8..048e7abb18 100644
--- a/src/detect-udphdr.c
+++ b/src/detect-udphdr.c
@@ -27,6 +27,7 @@
 #include "detect.h"
 #include "detect-parse.h"
 #include "detect-engine.h"
+#include "detect-engine-buffer.h"
 #include "detect-engine-mpm.h"
 #include "detect-engine-prefilter.h"
 #include "detect-engine-content-inspection.h"