smtp: check transaction before to-client completion - v1

[jasonish]

Ticket: https://redmine.openinfosecfoundation.org/issues/8739

SV_BRANCH=OISF/suricata-verify#3231

Make sure the transaction still exists before completing it in the
to-client direction. A pipelined RSET reply may already have completed and
freed it while a later end-of-DATA marker still refers to it.

Found by OSS-Fuzz testcase 5498180758994944.

[jasonish]

AI-generated review posted automatically by Suricata ai-review.

Verdict: approve

No actionable findings.

Redmine #8739: The null guard at src/app-layer-smtp.c:1084 prevents completion of a reclaimed transaction without falling back to an unrelated curr_tx, satisfying the ticket.

Linked suricata-verify PR #3231 provides adequate coverage. Its minimized 13-packet capture reproduces the pipelined RSET/DATA sequence; assertion-enabled main jobs fail pre-fix with exit -6, while the Suricata PR’s debug-validation job tests the fixed head using this fixture.

Validation: reviewed the complete one-commit diff from merge base 8455efd9, SMTP ownership/cleanup paths, PR timelines, Redmine #8739, and every linked test file and packet. git diff --check passed and the worktree remained clean. Per review instructions, no builds or tests were run locally. Broader CI, including the fixed-head debug-validation job, was still running.

Investigator and adjudicator both used Codex CLI with model gpt-5.6-sol at xhigh reasoning effort. Codex was the final adjudicator.

[suricata-qa]

WARNING:

field	baseline	test	%
	SURI_TLPR1_stats_chk
.app_layer.flow.ftp_data	655	679	103.66%

Pipeline = 32569

[catenacyber]

Thanks for the work,

CI : ✅
Git ID set : looks fine for me
CLA : you already contributed :-p
Doc update : not needed
Redmine ticket : ok, make sure to include this in your backport of #15837
Tests : cool
Dependencies added: none
Code : good
Commits segmentation : simple enough
Commit messages : nice