fix a very bewildering false positive scenario in o5logon format