All event_type:smb events have double tree_id in the eve logs. Version 6.0.9

Besides that I can confirm that this happens even on some of the suricata-verify tests. We created a bug tracking ticket for that at our redmine, see Bug #5811: SMB events sometimes have duplicate `tree_id` output. - Suricata - Open Information Security Foundation