fix(protocols)!: a declared length running past the data is accepted and zero-filled on rebuild

[JarryShaw]

• Searched for similar pull requests
• Followed the coding style — only mypy (no new errors on the touched source files) and isort were run; pylint was not
• make test passes, and a test case covers the change — not the full suite; legs below
• Added a changelog entry — N/A, added centrally

What is the purpose of your pull request?

• fix — corrects a defect
• feat · [ ] perf · [ ] refactor · [ ] test · [ ] docs · [ ] ci · [ ] release · [ ] chore

---

Description of your pull request and other information

Closes #1325. Implements ruling (1), strict everywhere. Breaking: what a malformed option looks like in info changes.

• Core: OptionField.unpack raises ProtocolError once an option that started with octets present reads past the data; an option starting exactly at the end keeps the EOOL handling (OptionField.unpack never returns for a well-formed HOPOPT header with an SMF_DPD option #431). Inside a parent layer the octets are kept as captured: raw extension data under IPv6, or a Raw payload elsewhere, as fix(protocols): a payload layer parsed from a short stream rebuilds default-filled octets #1171 does. Either way the frame rebuilds byte for byte.
• PCAP-NG: bounded_option now refuses a payload that runs past its area instead of clamping it. The new OptionAreaField keeps such an option or record area whole, as one bytes item. The block then parses with no options, the area is kept as options_raw or records_raw, and make writes it back verbatim. Extraction no longer aborts, and the round trip is byte-exact. bounded_area stays: it only keeps the trailing Block Total Length out of the option area.
• Rewritten pins: the IPv4 and TCP test_a_truncated_option_still_parses_its_declared_length tests (OptionField.unpack never returns for a well-formed HOPOPT header with an SMF_DPD option #431, The #431 truncated-option short read has no test, only its empty-tail case does #572), four fix(protocol): main is red, IPv4 make() with an unparsable raw item no longer raises the wrapped error #1394 raw-item cases, and the clamp pins in PCAPNGOptionAreaBoundTests and test_custom_option_shorter_than_pen_is_rejected.
• New tests: tests/protocols/test_declared_length_overrun_unit.py covers HOPOPT, IPv6-Opts, HIP, MH, TCP, IPv4 and SCTP. tests/protocols/misc/test_pcapng_option_area_kept_unit.py covers SHB, IDB, EPB, ISB, NRB and extraction. They fail when the fix is reverted: 22 fail with origin/main's collections.py, and 56 fail with origin/main's two PCAP-NG source files.

Leg results, all 0 failures: protocols/internet 552, protocols --exclude protocols/internet 1013, project 586, corekit 633. make_samples printed 0 case(s) left out.

[github-actions]

Coverage: 89.39% (unit tier, Python 3.14, bc5d90f7b, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18791	968	2352	869	90.90%
pcapkit/corekit	2038	89	634	25	94.76%
pcapkit/dumpkit	234	2	84	2	98.74%
pcapkit/foundation	2637	98	928	48	94.78%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	16354	219	4338	182	98.02%
pcapkit/toolkit	539	74	168	3	84.58%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Cross-review on bc5d90f7b: the reviewer's verdict was NEEDS CHANGES. My verdict is GOOD TO GO for #1325's scope (Sonnet reviewed; author Opus).

Why NEEDS CHANGES: "strict everywhere" is not fully met. None of the findings is a defect in this diff or a regression from main, so I filed them separately:

• question(pcapng): should the Journal Export binary-field clamp go strict like #1325? #1406 (needs: decision): the Journal Export binary-field clamp is still in place. It rebuilds 36 octets as 40, with the declared length rewritten from 100 to 8.
• fix(ipv4,tcp): a header length declared past the data zero-fills the missing octets on rebuild #1404: an IPv4 ihl or TCP data offset declared past the data still zero-fills (34 → 38 octets). This is a header-length gap, not an option length, and is identical on main. I reproduced it at this head.
• fix(pcapng): an EPB whose captured length runs past the block does not rebuild byte-exactly #1405: a PCAP-NG EPB whose captured_len runs past the block does not rebuild exactly (36 → 41). This is a block-level span, and is identical on main.

What the reviewer measured:

• Tests: the foundation leg is 522/0 and tests/integration is 90 passed with 2 skipped. These were the two legs the author had not run.
• Fixtures: across 1,614 frames from 23 captures, nothing differs from main and nothing raises.
• Fuzz, 3,000 seeds per family: rebuild failures fell from 1,252 on main to 213 here (IPv4/TCP/HOPOPT/IPv6-Opts), and from 4,165 to 543 (PCAP-NG). The PR adds no new failure, and no parse raises out of its parent.
• Test rewrites: the IPv4/TCP pins still assert real behaviour: a Raw payload, then an exact parent rebuild.
• Revert proof: reverting collections.py fails 19 tests.