[JarryShaw]

• Searched for similar pull requests
• Followed the coding style — not run; isort --check-only flags these files on origin/main too
• make test passes, and a test case covers the change — the modules below, not the full suite
• Added a changelog entry — N/A, added centrally

What is the purpose of your pull request?

• fix — corrects a defect

---

Description

Closes #1276
Closes #1279
Closes #1280
Closes #1282
Closes #1283
Closes #1284

Spec claims checked against draft-ietf-opsawg-pcapng-06 (and draft-richardson-opsawg-pcapng-extras-01 for #1280).

#	Before	After
1276	opt_comment é rebuilds 01000100 c3000000	01000200 c3a90000, byte-exact
1279	DSB with 3 secret octets: invalid length: 23	padded, Secrets Length stays 3
1280	journal entry: invalid length: 26	zero-padded to 32 bits
1282	NWK/APS Secrets Length rebuilds 20/24	18/22; the 2 zero octets are the block's padding_data
1283	EPB/PB 48, SPB 32, PCAP record 32 octets over snaplen 8	40/40/24 and 24
1284	ad0b0300 61626300 parses as pen=6513249	ProtocolError: [opt_custom] invalid length

Changes beyond the issue text:

• fix(pcap,pcapng): building a packet longer than the snaplen clips the declared length but writes every octet #1283: a snaplen of 0 now means no limit (spec: "A value of zero indicates no limit"). Before, it clipped captured_len to 0. Without this change, the new data clipping would empty those packets.
• fix(pcap,pcapng): building a packet longer than the snaplen clips the declared length but writes every octet #1283: the SPB parser now bounds its data by the block length and by interface 0's snaplen, so a clipped SPB re-parses.
• Tests: test_pcapng_unit.py:2206 pinned the unpadded journal entry b'raw'. It now expects b'raw\x00'.
• EXPECTED_FAILURES: both pcapng-secrets/* entries are deleted.
• Breaking: ZigBeeNWKKey/ZigBeeAPSKey schemas lose their padding field. A custom option with length < 4 now raises.

The new tests are in tests/protocols/misc/test_pcapng_roundtrip2_unit.py. With origin/main's three source files written back over the fix, it reports 10 failed, 1 passed (every test fails) and the option round-trip reports 2 failed. With the fix, it reports 8 passed, 3 subtests passed.

All 165 blocks of the six examples/captures/*.pcapng fixtures rebuild byte-exactly, except the big-endian SHB (#1272, in the follow-up PR). Test results:

• test_pcapng_unit 97 passed
• test_pcapng_roundtrip_unit 8 passed
• test_option_roundtrip_unit 6 passed / 362 subtests
• test_pcapng_regression 11 passed
• test_pcapng_end_to_end 6 passed
• pcap frame modules all pass
• run_unittest_leg.py protocols --exclude protocols/internet: 929 tests, 0 failures
• tests/project: 389 passed

test_runtime_engines.py::test_pcap_run_writes_global_header… fails identically on origin/main, so this PR does not cause it.

[JarryShaw]

Cross-review verdict on 68026d540: GOOD TO GO (Sonnet reviewed; author Opus).

• fix(pcapng): string option lengths count characters, not octets #1276: opt_comment rebuilds byte-exactly for '', é, 日本語, 😀, abcd, abcde and ébc; main fails every multi-byte case. All six string options are converted.
• fix(pcapng): Decryption Secrets Block never pads its secrets data #1279: with both pcapng-secrets/* entries gone the round-trip suite passes, and EXPECTED_FAILURES is now empty. fix(pcapng): systemd Journal Export Block is never padded on build #1280: journal entries of 3–11 octets rebuild (extras-01: "MUST be zero-padded to 32 bits"). fix(pcapng): ZigBee NWK/APS secrets length counts the padding (18 becomes 20, 22 becomes 24) #1282: NWK with Secrets Length 18 rebuilds; nothing reads the removed padding. fix(pcap,pcapng): building a packet longer than the snaplen clips the declared length but writes every octet #1283: pcapng-06 "A value of zero indicates no limit" confirmed; dhcp_big_endian.pcapng has snaplen 0. fix(pcapng): a custom option shorter than its 4-octet PEN reads the PEN from the padding #1284: option lengths 0, 1, 3 raise ProtocolError.
• Fixtures: 164/165 blocks rebuild alone — the miss is the big-endian SHB, which fix(pcapng): blocks and options rebuild as parsed (#1272, #1273, #1277, #1278, #1281, #1286) #1378 fixes. Per-frame info over 1588 frames is identical to main. Leg 929/0, tests/project 389, revert proof 10 failed / 1 passed.

Follow-ups filed (pre-existing or edge, not blocking): #1384 — an SPB longer than snaplen is silently truncated on parse; #1385 — a PCAP frame built with snaplen 0 writes no data. A DSB whose Secrets Length counted the padding (20) rebuilds as 18 — pcapng-06 is silent on which writers do.

[github-actions]

Coverage: 88.98% (unit tier, Python 3.14, 68026d540, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18777	1032	2348	843	90.27%
pcapkit/corekit	1949	84	606	20	94.91%
pcapkit/dumpkit	189	1	68	1	99.22%
pcapkit/foundation	2443	102	852	39	94.39%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	16035	206	4194	177	98.07%
pcapkit/toolkit	539	74	168	3	84.58%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2359	1006	158	42.84%

Per-file detail: the coverage-html artifact of this run.