dmarc-cat mixes up the sources of messages

[andrei caraman]

On an XML report (from Google), dmarc-cat (0.14.0-1 from Ubuntu 22.04.4) says

dmarc-cat 0.14.0,parallel/j12 by Ollivier Robert

Reporting by: google.com — <email address hidden>
From 2024-04-30 20:00:00 -0400 EDT to 2024-05-01 19:59:59 -0400 EDT

Domain: <domain>
Policy: p=quarantine; dkim=r; spf=r

Reports(2):
IP Count From RFrom RDKIM RSPF
strange_ip 3 <domain> <domain> pass pass
mx.<domain> 1 <domain> <domain> fail

but when inspecting the actual XML file, it becomes obvious that the three messages with "PASS" results came from the legit mail server of the domain, while the one "FAIL" message came from the strange_ip.
I can provide the actual XML report from Google.

[andrei caraman (adc27)]

I can confirm the same behaviour with

dmarc-cat 0.15.0,parallel/j12 by Ollivier Robert

from noble.

I too can provide an xml file with which this has been observed.