[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort) — ran pylint, mypy and isort with the Makefile flags on the two pcapkit/ files only. No new findings; mypy's 4 errors were already there.
• make test passes, and a test case covers the change — the modules run are listed below.
• Added a changelog entry — N/A, added centrally after the wave

What is the purpose of your pull request?

• fix — corrects a defect

---

Description of your pull request and other information

Closes #1267
Closes #1268
Closes #1269
Closes #1270
Closes #1271

• fix(pcapng): building any option that has a "only one" guard raises "option must be only one" (27 EXPECTED_FAILURES entries) #1267 __post_init__ resets self._opt between the pack and the re-parse.
• fix(pcapng): if_IPv6addr option hardcodes length=8 for a 17-octet field (EXPECTED_FAILURES pcapng-option/if_IPv6addr_5) #1268 if_IPv6addr declares length=17.
• fix(pcapng): isb_starttime / isb_endtime makers read _isb_interface_id, which only the parse path sets #1269 _make_block_isb sets _isb_interface_id before it builds the options.
• fix(pcapng): rebuilding an EPB, SPB or PB from its data model drops the packet octets but keeps the lengths #1270 EPB, SPB and PB rebuild their packet data from the parsed info's packet octets, cut to captured_len so a zero-length payload stays empty (fix(schema): a computed PayloadField length of 0 swallows the rest of the block #1275 can leave octets there). A model that has no packet rebuilds it from the decoded next layer instead.
• fix(pcapng): TLS and WireGuard key-log writers end lines with os.sep and inject datetime.now() #1271 Key-log lines end with \n, and the header comment no longer carries datetime.now(). A parsed TLS or WireGuard log also keeps its text as data, a key set by __update__ like protocols, and from_data writes that text back verbatim. Not breaking: no constructor signature changes.

Before → after. The repro in each issue now builds and rebuilds byte-exactly. Every block of examples/captures/*.pcapng goes through from_data byte-exactly: 120 EPB, 19 IDB, 14 ISB, 2 NRB, 1 SPB, 1 DSB, 1 systemd and 6 of 7 SHB. The one exception is the big-endian SHB, which is #1272.

EXPECTED_FAILURES. 33 of the 35 pcapng-* entries are removed. pcapng-secrets/{TLS,WireGuard}_Key_Log now fail with CONSTRUCT invalid length, recorded against #1279 (_make_block_dsb never pads). The newline-terminated logs are not 4-aligned, so the #1271 fix unmasked it.

Tests. The new tests/protocols/misc/test_pcapng_roundtrip_unit.py has 8 tests. Without the fix, 6 of them fail. The captured_len=0 test guards the #1270 fix itself: it passes on main, and fails without the cut (both subtests, original_len 0 and 60). The remaining one is a control and passes both ways: it checks that the "only one" guard still rejects a repeated option. test_pcapng_unit.py pinned if_IPv6addr length 8, so two of its assertions now expect 17.

Results:

• round-trip suite: 6 passed, 362 subtests
• test_pcapng_unit: 97 passed
• new module: 8 passed
• test_pcapng_regression: 11 passed
• test_pcapng_engine: 14 passed
• plist/json escaping regressions: 4 and 1 passed
• tests/project: 389 passed, 1 skipped
• run_unittest_leg.py protocols --exclude protocols/internet: 858 tests, 0 failures

[JarryShaw]

Cross-review verdict on 97c74a524: NEEDS CHANGES — one small fix (Sonnet reviewed; author Opus). The reviewer said GOOD TO GO and called one regression non-blocking. I re-derived it, and it blocks on its own.

A zero-length EPB regresses. With captured_len=0, the parsed packet field holds 20000000, which is the block's own trailing Total Length swallowed by the zero-length payload read (#1275). The new _make_packet_data then writes those octets back:

tree	rebuilt	exact
11ae68ebf	32 B	yes
this PR	36 B	no (malformed)
this PR merged with #1331	32 B	yes

So it is only correct if #1331 lands first. Slice the packet bytes to captured_len in _make_packet_data, so the PR stands alone in any merge order.

Everything else held:

• EXPECTED_FAILURES: imported on both sides, it goes from 35 to 2 entries. 33 were removed, none were added, and the two secrets entries now fail with [Block 10] invalid length: 230/126 (both 2 mod 4, which is fix(pcapng): Decryption Secrets Block never pads its secrets data #1279). They are stricter than before, not looser.
• K1: a genuinely repeated if_name is still rejected, both when built and when parsed.
• K2: 17 matches the pcapng draft and the library's own reader.
• K4: EPB, SPB and PB are byte-exact with and without packet across all 121 fixture blocks, including truncated EPBs.
• Fixtures: all 6 .pcapng captures rebuild block for block. The protocols leg reports 857 tests and 0 failures.

Worth a line each, not blocking:

• On a parsed secrets block, editing entries is silently ignored because data wins.
• The no-packet K4 fallback drops Ethernet pad octets and emits a mis-sized block.
• The secrets entries' expected length depends on __version__'s length, so a release could flip them into a false "delete the entry" alarm.

[JarryShaw]

Round-2 verdict on 901e123d4: GOOD TO GO. I verified the delta from 97c74a524 myself: 3 files, +36/−4.

• Blocker fixed. _make_packet_data now returns packet[:block.captured_len]. With this PR alone, an EPB with captured_len=0 rebuilds at an exact 32 octets, for both original_len 0 and 60. The parsed packet still holds the stray 20000000 until fix(corekit): signed NumberField decode, zero-length PayloadField, PCAP trailing bytes and empty Raw #1331 lands, but it is no longer written back, so the PR stands in either merge order. The new test_an_empty_epb_rebuilds_without_growing fails both subtests when the slice is removed.
• Docs added. A K4 note explains the slice, and that the fallback without packet is lossy. The K5 makers now state that data wins over entries on a parsed model. A comment on the two secrets EXPECTED_FAILURES entries warns that a __version__ length change can make them pass without fix(pcapng): Decryption Secrets Block never pads its secrets data #1279 being fixed.
• Checks. The Closes lines are still fix(pcapng): building any option that has a "only one" guard raises "option must be only one" (27 EXPECTED_FAILURES entries) #1267–fix(pcapng): TLS and WireGuard key-log writers end lines with os.sep and inject datetime.now() #1271. The protocols --exclude protocols/internet leg ran 858 tests with 0 failures.