[JarryShaw]

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort) — run on the changed files; no new findings beyond line length matching the neighbouring _read_block_short

• make test passes, and a test case covers the change — tests/protocols/misc per module, tests/project, and run_unittest_leg.py protocols --exclude protocols/internet only

• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

• fix — corrects a defect

---

Closes #1422

Byte-exact rebuild (PCAPNG.from_data(PCAPNG(raw).info).data), before → after, both byte orders: SHB 16→28 ⇒ 16, 20→28 ⇒ 20, 24→28 ⇒ 24; SHB 12 raised ProtocolError ⇒ 12; IDB 12→20 ⇒ 12, 16→20 ⇒ 16. Full SHB (28) and IDB (20) unchanged.

• SHB < 28 / IDB < 20: the body is kept as block_raw and written back by make(), as fix(pcapng)!: keep malformed journal entries and short packet blocks as captured (#1413, #1414) #1420 does for EPB/PB. Fields the block holds are decoded, the rest read as zero. Contract change: such blocks gain block_raw and no longer report fields over-read from the next block.
• A 12-octet SHB has no room for its magic. It takes the byte order in which its Block Total Length reads as 12, the only way to read it. A bad magic on any other length still raises ProtocolError.

Tests: new test_pcapng_short_shb_idb_1422_unit.py (8 tests, 60 subtests). Without the fix, 47 subtests and the extraction test fail. Rebased onto 949b0a900, which empties that stale KNOWN_GAPS allowlist; test_bitfield_coverage_unit.py now passes on this head. tests/project: 404 passed, 1 skipped.

[github-actions]

Coverage: 89.45% (unit tier, Python 3.14, 08dfbb05f, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18791	968	2352	869	90.90%
pcapkit/corekit	2038	89	634	25	94.76%
pcapkit/dumpkit	234	2	84	2	98.74%
pcapkit/foundation	2637	98	928	48	94.78%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	16615	221	4474	185	98.04%
pcapkit/toolkit	539	74	168	3	84.58%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Verdict: GOOD TO GO at 08dfbb05f (Sonnet cross-review; the author ran on Opus). CI: 38 ok, 0 failed, CLEAN.

• Byte-exact, re-derived by me with PCAPNG.from_data(PCAPNG(raw).info).data, in both byte orders:
  • PR: SHB 12/16/20/24/28 and IDB 12/16/20 all rebuild at their own length.
  • main (949b0a900): SHB 12 raises ProtocolError, SHB 16/20/24 rebuild as 28, IDB 12/16 rebuild as 20.
• 12-octet SHB inference: 0x0000000c reads as 12 in exactly one byte order. Other trailing lengths (0, 8, 13, 0x0C000000), a mixed-order trailer, and a bad magic on 16–28 octets all still raise ProtocolError. The fallback is only reachable from the SHB post_process.
• No over-read: in short SHB/IDB → IDB/SHB → EPB files, both byte orders, the EPB parses with interface_id 0 and captured_len 60.
• Tests bite: with the two source files reverted to main, 48 fail. With the PR, 8 tests and 60 subtests pass.
• Neighbours: 63 pcapng-touching modules across tests/ run one per process, plus test_bitfield_coverage_unit (3 passed). All green.
• The ! is justified: new block_raw key, same shape as fix(pcapng)!: keep malformed journal entries and short packet blocks as captured (#1413, #1414) #1420.
• Python 3.10: no 3.11+ API used.

Note, not blocking: a 12-octet IDB has no link type, so it reads as linktype=0, and a later EPB on that interface decodes as NULL, not Ethernet. The file carries nothing better. A 16-octet IDB's snaplen=0 is treated as "no limit"; the checks at pcapng.py:1201, 2190, 4226 and 4285 guard with if snaplen.