Suricata enforces 1-10 bytes when the string option is used and 1-4 bytes otherwise (DetectByteMathValidateNbytesOnly). Ticket: https://redmine.openinfosecfoundation.org/issues/8236