408 http code generated by mod_reqtimeout is not detected

Describe the bug

408 http code is not detected

Logs and dumps

1. SecDebugLog level 9:
   empty

If you change rule from "@streq 408" to "@streq 200" (for TEST PURPOSES ONLY), it blocks correctly and fill the SecDebugLog(SecDebugLog = 9) with informations. If you leave "@streq 408", debug log is empty and not blocking.

2. Apache error log:
   empty

3. Output of apache access log:

XXX.XXX.XXX.XXX - - [30/Oct/2023:16:45:33 +0100] "GET / HTTP/1.1" 408 448
XXX.XXX.XXX.XXX - - [30/Oct/2023:16:45:33 +0100] "GET / HTTP/1.1" 408 448
XXX.XXX.XXX.XXX - - [30/Oct/2023:16:45:33 +0100] "GET / HTTP/1.1" 408 448
XXX.XXX.XXX.XXX - - [30/Oct/2023:16:45:33 +0100] "GET / HTTP/1.1" 408 448
XXX.XXX.XXX.XXX - - [30/Oct/2023:16:45:33 +0100] "GET / HTTP/1.1" 408 448
XXX.XXX.XXX.XXX - - [30/Oct/2023:16:45:33 +0100] "GET / HTTP/1.1" 408 448
XXX.XXX.XXX.XXX - - [30/Oct/2023:16:45:33 +0100] "GET / HTTP/1.1" 408 448
XXX.XXX.XXX.XXX - - [30/Oct/2023:16:45:33 +0100] "GET / HTTP/1.1" 408 448
XXX.XXX.XXX.XXX - - [30/Oct/2023:16:45:33 +0100] "GET / HTTP/1.1" 408 448
XXX.XXX.XXX.XXX - - [30/Oct/2023:16:45:33 +0100] "GET / HTTP/1.1" 408 448

To Reproduce

1. Install Ubuntu + apache + reqtimeout + mod security
2. Use rules below
3. Make slowloris attack from server to server:
   wget https://raw.githubusercontent.com/GHubgenius/slowloris.pl/master/slowloris.pl && perl slowloris.pl -dns SERVER_IP -port 80 -timeout 3 -num 750
4. You will see, apache 408 in access.log, but modsecurity do nothing.

If you change rule detection "408" to "200", it is working (blocking). So, there is any problem with http code 408. Not with the rule itself.

Expected behavior

Detect 408 http code correctly and block attacker

Server (please complete the following information):
Ubuntu 20 TLS (Ubuntu 16 and 18 same problem)
Apache/2.4.58 (Ubuntu) + mod_reqtimeout (lower Apache 2.4.x versions same problem)
libapache2-mod-security2 2.9.3-1ubuntu0.1 (2.9.2 and 2.9.0 same problem)

Rule Set (please complete the following information):

SecRule RESPONSE_STATUS "@streq 408" "id:20,phase:5,t:none,nolog,pass,setvar:ip.slow_dos_counter=+1,expirevar:ip.slow_dos_counter=60,ctl:ruleEngine=On"
SecRule IP:SLOW_DOS_COUNTER "@gt 5" "id:21,phase:1,t:none,log,deny,status:403,msg:'SlowlorisAttack',ctl:ruleEngine=On"

Additional context

Start by reproducing the issue with Apache, mod_reqtimeout, the two SecRule definitions, and the supplied slowloris command. Trace how phase 5 evaluates RESPONSE_STATUS when Apache generates a 408, especially compared with a 200 response. Done means repeated 408 responses are detected and the counter rule can block the attacker, with regression coverage for this behavior.