[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change — new test added; legs below run, not the whole suite
• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Description of your pull request and other information

• fix(ipv6): a cut upper layer after an extension header falls back to Raw that duplicates the header #1471: beholder (pcapkit/utilities/decorators.py) built its Raw fallback from self._get_payload(). It ignored the payload IPv6 passes for the octets past its extension headers, so a cut upper layer held those headers twice. It now uses the passed payload when there is one.
• fix(ipv6): from_data(info.to_dict()) crashes when an IPv6_Ext stands in for a dedicated extension header #1473: IPv6._lookup_exthdr picked the dedicated parser from the next code, even for an entry IPv6_Ext had parsed and written under its ext key. The key now decides: ext rebuilds with IPv6_Ext. This also fixes the HIP dict-rebuild AttributeError noted in fix(ipv6): a cut upper layer after an extension header falls back to Raw that duplicates the header #1471.

Breaking (owner ruling on this PR): info.raw.packet changes when the upper layer is cut. Behind extension headers, it no longer repeats those headers: for a DST+TCP cut, it was 060001040000000000 and is now 00. For a decrypted ESP payload, the Raw fallback no longer includes the ESP trailer; it now matches Data_ESP.plaintext. The info keys, Raw.length and the protochain are unchanged.

tests/protocols/internet/test_ipv6_exthdr_cut_rebuild_unit.py covers every cut of 7 chains over IPv6 and Ethernet, checking the parse, from_data(info) and from_data(info.to_dict()). On origin/main sources: 429 failed, 2 passed, 1130 subtests passed. With the fix: 3 passed, 1558 subtests passed.

Also passing: the four edge modules, test_capture_roundtrip_runtime.py, run_unittest_leg.py protocols/internet (620 tests, 0 failures) and tests/project. The json and tree dumps of all 23 examples/captures are byte-identical to origin/main.

Closes #1471
Closes #1473

[github-actions]

Coverage: 89.56% (unit tier, Python 3.14, fd77588a0, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18795	958	2356	871	90.99%
pcapkit/corekit	2107	93	672	27	94.60%
pcapkit/dumpkit	242	2	88	2	98.79%
pcapkit/foundation	2648	98	930	48	94.80%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	17056	239	4612	192	97.96%
pcapkit/toolkit	539	74	168	3	84.58%
pcapkit/utilities	431	4	124	4	98.56%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Verdict: GOOD TO GO at b59db0a3f. Cross-reviewed on Sonnet; the author ran on Opus. No defect found.

• Cut chains: the reviewer built 25 chains of its own (Routing 0/2, SRH, Fragment, Mobility, repeated DST, ESP/AH, Shim6, stand-ins) and cut each at every offset, 1886 cases in all. Main has 1122 failures; the head has 0. Nothing that passed on main fails on the head.
• Captures: 213,856 Ethernet cuts across the 23 captures give identical results on main and the head, with 0 failures. The to_dict() hashes per capture are identical too.

One visible value change, and the question it raises. info.raw.packet for a cut upper layer behind extension headers no longer repeats the headers. I measured a DST+TCP cut: 060001040000000000 on main, 00 on the head. Decrypted ESP is affected the same way: its Raw fallback drops the ESP trailer.

• Asking the owner: should the title get a !? fix(sctp)!: keep the octets after the last whole chunk as captured (#1468) #1472 took one for a comparable value correction.
• The PR body: it should also name ESP among the affected callers.

Not a blocker in its own right. Two follow-ups, neither needed for merge:

• _exthdr_key relies on IPv6_Ext.alias.fget(None), which is safe only while that property ignores self. A module-level constant would remove that fragility.
• An ESP test would pin the behaviour change.

[JarryShaw]

Sounds like a breaking change? Yea update the body as well.

[JarryShaw]

Recorded: the owner rules this a breaking change. I have added the ! to the title and the breaking label. The body now has a Breaking paragraph covering the raw.packet change behind extension headers and the decrypted-ESP case. The head is unchanged, so the GOOD TO GO at b59db0a3f stands.

[JarryShaw]

Verdict carried to fd77588a0: GOOD TO GO. This is a pure rebase onto main at bbfd4bf64, after #1475 merged. range-diff shows the one commit as =, and the stable patch-id is unchanged (46c969fa378d).