[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Description of your pull request and other information

Closes #1545.

After #1540 a Fragment header with a non-zero offset ends the extension-header walk, but IPv6._decode_next_layer still dispatched the rest on its Next Header. So ipv6.pcap frames 14–16 read as IPv6-Frag:UDP:Raw with garbage ports. Now no code is dispatched for a known non-zero offset, and the rest is a Raw leaf with no protocol alias. Frames 14–16 read Ethernet:IPv6:IPv6-Frag:Raw, which matches tshark (ipv6.fraghdr:data), and 'UDP' in frame is false.

• protocol still names the first fragment's upper layer, and fragment/hdr_len/raw_len are unchanged. Reassembled datagrams over every capture under examples/captures/ are identical before and after (IPv6: one 4778-octet datagram from frames 13–16).
• A Fragment header parsed with no offset (IPv6_Ext stand-in) still dispatches as before, since it is not known to be a later fragment.
• Tests: the new test_ipv6_later_fragment_raw_unit.py covers UDP and TCP at four offsets, M set and clear, make→parse, and a first/atomic-fragment guard. test_ipv6_extension_runtime.py covers frames 14–16; its frame-16 chain pin had encoded the bug. Round trips stay byte-exact.
• The dpkt and scapy engines already read these frames as raw (bytes and Raw). No Gap rows cite fix(protocols): a non-first IPv6 fragment's data is dissected as an upper-layer header #1545.

[JarryShaw]

Verdict: GOOD TO GO at 50cbc5f21. Cross-reviewed on Sonnet; the author ran Opus.

• Behaviour: ipv6.pcap frames 14–16 now chain Ethernet:IPv6:IPv6-Frag:Raw, which matches tshark (data). Frame 13 is unchanged. Across 1,590 frames in every capture, no other chain changes, and reassembly gives 1,571 datagrams hash-identical to main.
• 24 hand-built cases:
  • A later fragment stays Raw behind HBH, Routing, Dest-Opts, AH and combinations of them, whatever its Next Header.
  • First and atomic fragments still dissect.
• Round trips: all 16 ipv6.pcap frames are byte-exact through from_data(info), from_data(info.to_dict()) and re-parse.
• Fail-before: the PR's tests give 21 failed on main's ipv6.py.
• With fix(toolkit): the pypcapfile engine warns that it leaves TCP over IPv6 out (#1513) #1535: merged together, test_pypcapfile_unit.py gives 35 passed in 3.11.

One reviewer finding I refuted: the review asked for a test pinning the "offset unknown" guard (ipv6.py:625), saying an opaque = True mutant survives. I ran that mutant. It is killed by the existing test_ipv6_unit.py::test_ipv6_decode_next_layer_handles_extension_headers_and_fragments (None != <TransType.UDP: 17>). The review had not run that file, so no change is needed.

Not blocking:

• Once fix(toolkit): the pypcapfile engine warns that it leaves TCP over IPv6 out (#1513) #1535 lands, toolkit/pypcapfile.py:342/:353 and test_pypcapfile_unit.py:480 say the default engine dissects behind a later fragment, which goes stale. That rewording belongs to whichever PR lands second.
• make() of a later fragment with a UDP object no longer keeps UDP as a layer, though it stays byte-exact.

[github-actions]

Coverage: 90.02% (unit tier, Python 3.14, 50cbc5f21, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18795	842	2356	756	92.09%
pcapkit/corekit	2204	67	712	34	96.26%
pcapkit/dumpkit	258	2	90	2	98.85%
pcapkit/foundation	2797	132	986	48	94.18%
pcapkit/interface	108	7	36	5	91.67%
pcapkit/protocols	16994	229	4546	190	98.03%
pcapkit/toolkit	635	98	198	5	83.31%
pcapkit/utilities	431	4	124	4	98.56%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.