[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in chore(docs): centralise changelog entries for unreleased versions #2483

What is the purpose of your pull request?

• fix — corrects a defect

---

Three rebuild and cut-recording gaps found while reviewing #2703.

• An outer rebuild repeated its payload's messages. While a payload is rebuilt inside _make_payload, its warnings are held, and beholder absorbs errors quietly. The outer layer's own parse still reports each message once. The owner ruled for this on fix(protocols): rebuild noise and cut-recording gaps found reviewing #2703 #2711, and the "Handled Refusals" page records the exception.
• A directly built IGMPv3 Report cut on a field boundary read INVALID. The record count now sizes the records in a standalone parse, so cuts at 8, 20 and 24 read TRUNCATED, as they do behind IPv4. A count past IP_MAX_LENGTH raises ProtocolError. Where the zero-fill budget would be exceeded, the parse reads as on main, so it never newly raises.
• A layer records a cut when its captured octets fall short of the length it declares (owner, option 1). Schema.unpack notes a cut in a declared payload. A frame cut is recorded on a layer only through Schema._frame_end_field, whose last field is sized by the length the layer was given. That covers GRE, ICMP, IGMP, Ethernet and TSO IPv4. A layer that declares its own extent records nothing past it, and neither does one that ends in a list. Those are IPv4, IPv6, UDP, HTTP/2, SCTP and the option-area headers. ICMPv4.read reads a recorded cut as TRUNCATED.

The shipped captures keep their octets and messages, and every per-layer rebuild is exact; only genuinely cut layers gain __short_read__. The new tests fail on main. A trial merge with #2737 passes both sides' tests.

Closes #2711

[JarryShaw]

GOOD TO GO at c9e0c968a, from a Sonnet review (round 4).

• SCTP fixed: behind Total Length 0, cut at every octet, 264 cases: data runs to the cut, nothing is recorded, every rebuild is exact.
• IGMPv3 fallback: _zero_fill_refusal leaves the budget untouched and agrees with the guard. Header-only counts of 1–16 read TRUNCATED, 17–8190 read as on main, and 8191 and above raise ProtocolError. Nothing else raises at any budget. The budget-dependent outcome is the open question on fix(protocols): rebuild noise and cut-recording gaps found reviewing #2703 #2711.
• Merge with fix(internet)!: read a cut after an IPv6 option's type octet as a short read (#2727) #2737: both sides' modules pass together, and about 685 modules pass overall.

[github-actions]

Coverage: 94.44% (unit tier, Python 3.15, 2ade9f4b3, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	20918	175	2908	156	98.57%
pcapkit/corekit	2889	76	928	37	96.83%
pcapkit/dumpkit	286	3	102	3	98.45%
pcapkit/foundation	3505	27	1216	32	98.75%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	22694	154	5898	126	99.01%
pcapkit/toolkit	961	26	342	8	96.62%
pcapkit/utilities	559	7	150	5	98.31%
pcapkit/vendor	5590	2286	1280	214	55.75%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

NEEDS CHANGES, following the ruling on #2711 (option 2). An overstated count in a standalone header-only IGMPv3 Report must read deterministically. Records past those present are never zero-filled, and the cut is recorded through a new list-field mechanism, not the zero-fill budget. Round 5 is in progress; the rest of the PR stands.

[JarryShaw]

resolve conflicts

[JarryShaw]

Will do. #2737 has merged, so this PR now conflicts with main in the Schema.unpack docstring; the two changes were already known to compose. Round 5, for the option-2 ruling, is in progress on c9e0c968a. It will be rebased onto main with #2737, the composed tests rerun, and pushed as one revision.

[JarryShaw]

Round 5 (option 2) is pushed, rebased onto main dea098b15: c9e0c968a → 2ade9f4b3. Conflicts resolved.

• ListField takes a new count. A list holding fewer items than it counts records the shortfall as a short read, so a standalone Report reads TRUNCATED deterministically. It never zero-fills past the data, and the zero-fill budget check is gone.
• The Schema.unpack docstring conflict with fix(internet)!: read a cut after an IPv6 option's type octet as a short read (#2727) #2737 keeps both paragraphs. Both short-read calls now pass packet, so later fields see __short_read__, and a test pins that.
• All four legs pass, the docs: a doc comment whose first line has a colon renders its prose as a Type field #2745 guard passes and every new-code mutant is killed. A cross-review is running.

[JarryShaw]

GOOD TO GO at 2ade9f4b3, from a Sonnet review of round 5.

• Deterministic: tested at counts 1, 2, 17, 100, 1000 and 8190 with 0–2 records present. Each reads the same fresh and after the context had read ~40 KB. It is TRUNCATED with the same short-read record, and nothing is zero-filled. 8191 and up raises ProtocolError both times.
• Round-trips are byte-exact, overstated count included. Nine IPv4 frames come out byte-identical to round 4.
• ListField without count behaves as before, and only Report opts in. The packet test fails without the argument. Project tests and Lint pass.
• The two calls: a count-only ceiling on parse is fine, since make() is where too-large values raise. The direct-parse packet length < 0 warning is unchanged from main and is tracked separately.