[Bug]: Free/busy scheduling outbox returns spurious BUSY-UNAVAILABLE for a sub-day query window when availability/working-hours is set

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I attempted to get FREE / BUSY times via CalDAV from a Nextcloud server for a team member and noticed an incorrect response, if the DTSTART / DTEND doesn't cover a full day.

The following responses were returned for the same user, same day:

correct response for full-day query

DTSTART:20260610T220000Z / DTEND:20260611T215900Z:

  FREEBUSY;FBTYPE=BUSY-UNAVAILABLE:20260610T220000Z/20260611T070000Z
  FREEBUSY:20260611T123000Z/20260611T130000Z
  FREEBUSY;FBTYPE=BUSY-UNAVAILABLE:20260611T150000Z/20260611T215900Z

i.e. free 07:00Z–12:30Z and 13:00Z–15:00Z

incorrect response for sub-day query

DTSTART:20260611T080000Z / DTEND:20260611T140000Z:

  FREEBUSY;FBTYPE=BUSY-UNAVAILABLE:20260611T080000Z/20260611T123000Z
  FREEBUSY:20260611T123000Z/20260611T130000Z
  FREEBUSY;FBTYPE=BUSY-UNAVAILABLE:20260611T130000Z/20260611T140000Z

08:00Z–12:30Z and 13:00Z–14:00Z reported BUSY-UNAVAILABLE

Steps to reproduce

1. As any user, configure Availability (working hours) in Settings → Groupware (e.g. Mon–Fri 09:00–17:00), so the server stores a VAVAILABILITY.
2. make a free/busy request with the user from step 1 as an attendee:

   curl -u 'user:APP_PASSWORD' \
    -H 'Content-Type: text/calendar; charset=utf-8' \
    --data-binary @- \
    'https://cloud.example.com/remote.php/dav/calendars/serviceuser/outbox/' <<'EOF'
   BEGIN:VCALENDAR
   VERSION:2.0
   PRODID:-//repro//EN
   METHOD:REQUEST
   BEGIN:VFREEBUSY
   UID:repro-1
   DTSTAMP:20260611T070000Z
   DTSTART:20260611T000000Z
   DTEND:20260612T000000Z
   ORGANIZER:mailto:user@example.com
   ATTENDEE:mailto:attendee@example.com
   END:VFREEBUSY
   END:VCALENDAR
   EOF
   

3. Repeat with a narrow window inside the working hours, changing only DTSTART:20260611T110000Z and DTEND:20260611T130000Z.
4. Compare the FREEBUSY lines for the attendee in the two cal:schedule-response payloads.

Expected behavior

Free/busy for a sub-window must be consistent with the full-day result

Nextcloud Server version

33

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.5

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "overwritehost": "cloud.xxx.yyy",
        "overwriteprotocol": "https",
        "overwrite.cli.url": "https:\/\/cloud.xxx.yyy",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.xxx.yyy",
            "office.xxx.yyy"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "33.0.5.1",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "loglevel": 2,
        "installed": true,
        "app_install_overwrite": [
            "richdocumentscode",
            "news"
        ],
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [],
        "twofactor_enforced_excluded_groups": [],
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": true,
        "mail_smtpport": "587",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "trashbin_retention_obligation": "30,30",
        "theme": "",
        "default_phone_region": "DE"
    }
}

List of activated Apps

occ app:list
Enabled:
  - activity: 6.0.0
  - admin_audit: 1.23.0
  - app_api: 33.0.0
  - appointments: 2.7.3
  - bruteforcesettings: 6.0.0
  - calendar: 6.4.2
  - circles: 33.0.0
  - cloud_federation_api: 1.17.0
  - collectives: 4.4.1
  - comments: 1.23.0
  - contacts: 8.5.1
  - dashboard: 7.13.0
  - dav: 1.36.0
  - deck: 1.17.3
  - federatedfilesharing: 1.23.0
  - federation: 1.23.0
  - files: 2.5.0
  - files_downloadlimit: 5.1.0
  - files_external: 1.25.1
  - files_pdfviewer: 6.0.0
  - files_reminders: 1.6.0
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - firstrunwizard: 6.0.0
  - impersonate: 4.0.0
  - logreader: 6.0.0
  - lookup_server_connector: 1.21.0
  - news: 28.6.0
  - nextcloud_announcements: 5.0.0
  - notifications: 6.0.0
  - notify_push: 1.3.3
  - oauth2: 1.21.0
  - password_policy: 5.0.0
  - photos: 6.0.0
  - privacy: 5.0.0
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - recommendations: 6.0.0
  - related_resources: 4.0.0
  - richdocuments: 10.2.0
  - serverinfo: 5.0.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - spreed: 23.0.6
  - support: 5.0.0
  - survey_client: 5.0.0
  - systemtags: 1.23.0
  - text: 7.0.1
  - theming: 2.8.0
  - twofactor_backupcodes: 1.22.0
  - twofactor_totp: 15.0.0
  - twofactor_webauthn: 2.7.0
  - updatenotification: 1.23.0
  - user_status: 1.13.0
  - viewer: 6.0.0
  - weather_status: 1.13.0
  - webhook_listeners: 1.5.0
  - whiteboard: 1.5.9
  - workflowengine: 2.15.0
Disabled:
  - contactsinteraction: 1.14.1 (installed 1.8.0)
  - encryption: 2.21.0
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - suspicious_login: 11.0.0
  - twofactor_nextcloud_notification: 7.0.0
  - user_ldap: 1.24.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Additional info

No response

Start by reproducing the discrepancy through the remote.php/dav/calendars/serviceuser/outbox/ endpoint with the full-day and narrow DTSTART/DTEND requests shown. Trace the free/busy response handling for the configured VAVAILABILITY and verify that the sub-window response remains consistent with the full-day availability result.