[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in chore(docs): centralise changelog entries for unreleased versions #2483

What is the purpose of your pull request?

• feat — a new feature

---

Description of your pull request and other information

DTLS 1.3 unified-header records with the C bit set (RFC 9147 §4) now parse as DTLS 1.3 layers. Their connection-ID length comes from #2631's DTLSContext, in one of two ways:

• IDs that the capture's hellos negotiated, matched by value;
• a caller-supplied cid_length.

The matcher is #2631's, extended rather than duplicated. A fit needs room for the 16-octet record-number sample, so a shorter learned ID is not misread as a longer one. IDs sent later in DTLS 1.3's encrypted NewConnectionId can come only from the caller; this is documented. With no known length, the record stays Raw quietly. The owner's #2515 rulings hold: memory is per instance, and cid_length is a single value.

Test vectors come from a real wolfSSL 5.9.4 DTLS 1.3 CID exchange, and tshark agrees on every record. Both round trips are byte-exact. The only change to existing output is a cid: None key on unified-header records without a CID; that is option 1 of the open question on #2625. A Sonnet cross-review returned GOOD TO GO, and its hardening and two mutant-killing tests are folded in.

Closes #2625

[JarryShaw]

GOOD TO GO at a0807371b, from a Sonnet cross-review.

• Layout: it checked the RFC 9147 Figure 3 layout.
• tls12_cid regression check: 30,000 random match() calls and 6,000 record parses gave the same result on this branch as on main.
• Prefix adversary: a 16-case prefix grid and 40,000 prefix-heavy records.
• tshark: re-run against the capture, matching on all 12 frames.
• Round trips: 5,000 random round trips were byte-exact.

The fix round adds two things the review asked for. The fit now needs room for the 16-octet record-number sample, which removes the prefix ambiguity. Tests now kill the two mutants that survived, M5 (cid_length tried before learned IDs) and M3 (the no-length boundary). The tls12_cid defaults are unchanged.

This branch conflicts with #2638 in DTLS.make(), so whichever merges second needs a rebase.

[JarryShaw]

Fix round and rebase: a0807371b → e919d1c43, now on 16ccc4373 (#2645). Only tests/corekit/test_schema_roundtrip_unit.py changes.

• The round-trip harness picked a DTLSCiphertext instance with the C bit clear, so it never read the CID. drivers() stops searching a bit-field subfield that an OVERRIDES entry sets, and the case's override pins C with a non-empty CID.
• A PARSE_CONTEXT entry gives the reparse __cid_length__, as fix(tests): the schema round trip cannot reparse DTLSCIDCiphertext, failing main's Python 3.15 leg #2645 does for DTLSCIDCiphertext.

The patch-id changed and the change touches a shared harness, so the label is review: running while a Sonnet re-review checks every schema's chosen instance with and without the pin.

[JarryShaw]

NEEDS CHANGES at e919d1c43, from a Sonnet re-review.

• Required: nothing fails if the pin is removed. With drivers()'s pin deleted, the round-trip module still passes because it builds 2000, the same silent skip this round fixes. Add a guard: no subfield an override sets may be searched, or the case's built octets are 30 01020304 00.
• Confirmed: across every schema, the pin changes only DTLSCiphertext's two builds, with outcomes identical. PARSE_CONTEXT is needed for the reparse.
• Optional: a callable override returning a flags dict is not pinned. Reword the docstring to "a dict override", or resolve callables the way _base_values does.

CI on this head is cancelled until the fix round lands.

[JarryShaw]

Fix round: e919d1c43 → d86dbdd1f, same base 16ccc4373.

• Pin guard: test_an_override_pins_the_bit_field_subfields_it_sets fails when the pin is removed.
• Context guard: test_each_parse_context_entry_is_read_by_its_case builds each PARSE_CONTEXT case without its context and expects the reparse to fail, so an entry that does nothing fails it.
• Callable overrides: a new overrides_of resolves them for _base_values, drivers() and the guard alike, so a callable override that returns a flags dict is pinned too.

The label is review: running while the same reviewer checks this round.

[JarryShaw]

GOOD TO GO at d86dbdd1f, from the same Sonnet reviewer.

• Removing the pin fails both new guards, and removing the case's override fails the context guard.
• Across every schema, the old and new harness pick identical instances and give identical outcomes. overrides_of resolves exactly as the inline code did, and a callable flags override now pins too.
• Not blocking: with the pin kept and cid dropped from the override, the case still passes as a degenerate record. Asserting the built octets contain the CID would close it.

[github-actions]

Coverage: 94.08% -- tests failure, so this is partial (unit tier, Python 3.15, d86dbdd1f, Unit Tests run failure)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	20561	177	2832	158	98.53%
pcapkit/corekit	2697	74	854	37	96.65%
pcapkit/dumpkit	281	3	100	3	98.43%
pcapkit/foundation	3475	27	1206	32	98.74%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	21439	219	5662	197	98.45%
pcapkit/toolkit	961	28	342	10	96.32%
pcapkit/utilities	512	7	144	5	98.17%
pcapkit/vendor	5256	2260	1198	194	53.61%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Resolve conflicts

[JarryShaw]

The owner asked for the conflicts to be resolved. A rebase onto main (3e93eea1a) is in progress with this PR's worker. The note follows when it is pushed.

[JarryShaw]

Conflicts resolved, rebased onto main (3e93eea1a): d86dbdd1f → 3cf3a27df.

• The only conflicts were two hunks in DTLS.make() against refactor(protocols): finish the shared value helpers on ProtocolBase and move TLS onto them #2638. Both sides are kept: this PR's cid check runs first, then main's _make_pack calls, unchanged. The Raises section lists this PR's ProtocolError cases together with main's StructError and FieldValueError.
• Everywhere else the patch is unchanged (identical patch-id outside dtls.py).
• The re-export test passes on this base. The capture differential against main is the same as before the rebase, and tshark agrees on both captures.

The verdict stays good to go.