From a824d97d71feca651d1ecb6cb4729361a583f80f Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Thu, 2 Jul 2026 14:47:26 +0200
Subject: [PATCH] detect: use sub state to select inspect engines

When building the per signature app_inspect list, only add engines
that match the sub state specified in the hook.
---
 src/detect-engine.c | 5 +++++
 src/detect-parse.c  | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/src/detect-engine.c b/src/detect-engine.c
index 591cf855f9..437408cc35 100644
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -742,6 +742,11 @@ static void AppendAppInspectEngine(DetectEngineCtx *de_ctx,
             if (!(AppProtoEqualsStrict(s->alproto, t->alproto))) {
                 return;
             }
+
+            /* skip engines not for us */
+            if (s->init_data->hook.t.app.sub_state != t->sub_state) {
+                return;
+            }
         } else {
             /* other rules use the more relax AppProtoEquals logic */
             if (!AppProtoEquals(s->alproto, t->alproto)) {
diff --git a/src/detect-parse.c b/src/detect-parse.c
index e8225c98cf..e6a2fcedc1 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -2869,6 +2869,8 @@ static int SigValidateCheckBuffers(
                 if (!(AppProtoEqualsStrict(s->alproto, app->alproto))) {
                     continue;
                 }
+                if (app->sub_state != s->init_data->hook.t.app.sub_state)
+                    continue;
             } else {
                 if (!(AppProtoEquals(s->alproto, app->alproto) || s->alproto == 0)) {
                     continue;