[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in chore(docs): centralise changelog entries for unreleased versions #2483

What is the purpose of your pull request?

• fix — corrects a defect

---

Description of your pull request and other information

Some complete but malformed MH messages and MPTCP DSS options did not rebuild as captured. A Home Test with Header Len 1 rebuilt from 24 octets to 32, and its 64-octet IPv6 packet to 72. Both now refuse, as their siblings do:

• MH.read raises ProtocolError when a message's fixed fields run past its declared Header Len while that window was fully captured. RFC 6275 has such a message discarded, and IPv6 Routing type 2 and HIP already refuse a header length too short for their fields. Inside IPv6 the octets stay a Raw payload, so the packet rebuilds byte for byte.
• TCP._read_mptcp_dss refuses any Length other than the one RFC 8684 gives for its A/a/M/m flags (plus 2 for the checksum), as every other MPTCP subtype and fixed-length TCP option already refuses lengths outside its RFC set.

A Header Len longer than the fields round-trips as before. A capture cut inside a message, including one whose Header Len is too short, keeps its declared Header Len through replay_short_read, so it rebuilds as captured.

Breaking: MH(raw) and TCP(raw) raise ProtocolError where they used to return a mis-parse. Mutation tests change one octet at a time in every MH message type, alone and in IPv6, and try every DSS flag combination at every length; both fail on main. Shipped captures parse identically to main.

Closes #2669

[JarryShaw]

NEEDS CHANGES at 58d3c8861, from a Sonnet cross-review. The fix is correct and nothing regressed: RFC 6275 has a Header Len below a message's minimum discarded, RFC 8684 fixes DSS's length by its flags, and every shipped capture parses identically. What is left:

1. Pin the capture-cut property. Dropping the __short_read__ conjunct of MH.read's guard makes every cut valid Home Test raise, and no test notices. Add a test that a valid-Header-Len message cut anywhere in its window parses and rebuilds exactly.
2. A cut inside a malformed MH (Header Len 1, captured to 8–15 octets) still rebuilds with Header Len 2. That is the same class of defect, so fold it in, or say why it needs refactor(protocols)!: make() takes enum members or ints, dropping the X_default/X_namespace/X_reversed groups #2594.
3. Wording: the Home Test is RFC 6275 §6.1.5, not §6.1.6. Drop the timed words from the test docstrings, and the body's IPv6 figure needs correcting.
4. Labels: MH(raw) and TCP(raw) now raise where they used to return a mis-parse, so this gets breaking and a ! subject.

The mobility-option side findings are confirmed and filed as #2684.

[JarryShaw]

GOOD TO GO at 1b7807da5, from a Sonnet re-review. All four earlier findings are fixed:

• The cut test kills the __short_read__ mutant: 86 subtests fail without it.
• A cut inside a malformed MH keeps its Header Len through replay_short_read, so it rebuilds exactly, alone and inside IPv6. Whole and edited models still recompute.
• The toolkit fixture still tests fix(toolkit): pypcapfile's _default_extension_header still reports a raising trial's warnings #2526.
• Wording is right: RFC 6275 §6.1.5, and the figures measure 24→32 and 64→72.

Shipped captures are identical to main, and the MH, IPv6, TCP, MPTCP and toolkit legs pass. The option-field cut refusals the test allows are identical on main. They are not this PR's, and are filed separately.