Suricata

I have observed this with basically any of the 2 major stable versions plus latest git master.
This is not reproducible as a pcap or copy paste config example but rather in the following manner:

When filemagic (as part of fileinfo logs) is enabled on a busy system that has been tuned and the CPUs are not pegged, running with no drops - that immediately results in drops.
It is not necessarily that the CPUs or perf top will expose the problem in terms of busy function.

A way to observe this is with Trex or pktgen setup for example.
I can share examples.

Similar issue is observed when enabling checksums in fileinfo.