[JarryShaw]

• Searched for similar pull requests
• Followed the coding style — make isort is clean per tests/project/test_isort_clean.py; pylint and mypy not run
• make test passes, and a test case covers the change — the modules below, not the full suite
• Added a changelog entry — N/A, added centrally

What is the purpose of your pull request?

• fix — corrects a defect

---

Description

Closes #1272
Closes #1273
Closes #1277
Closes #1278
Closes #1281
Closes #1286

Spec claims are checked against draft-ietf-opsawg-pcapng-06:

• the flags bits are LSB-0, per the NOTE under Table 5
• epb_verdict is "multiple allowed: yes"
• NRB names and ns_dnsname are UTF-8

#	Before	After
1272	dhcp_big_endian.pcapng SHB rebuilds 4d3c2b1a (LE)	rebuilds big-endian; make(block={'byteorder': 'big'}) also works
1273	make(direction=INBOUND) writes 00000040; wire e5010000 → ValueError	01000000; (1, 1, 15)
1277	NRB names ('愮數慭灬攀戮數慭灬攀',)	('a.example', 'b.example'); a non-UTF-8 name rebuilds byte-exactly
1278	unknown block: invalid length: 8	byte-exact
1281	two verdicts: option must be only one, but 2 found	byte-exact
1286	format: {line!r}	format: 'a b c'

Breaking changes:

• EPB_FlagsOption/PACK_FlagsOption gain a required reserved field (bits 9-23, verbatim), and the makers gain reserved=0.
• The schema flags is a new LSB-0 FlagsField that reads the word in the section's byte order.
• An undefined direction (0b11) or reception (5-7) raises ProtocolError.
• A WireGuard line without exactly three fields now raises FieldValueError instead of ValueError.

Judgement call: bits 9-11 (checksum and TSO offload) and 16-23 sit inside reserved instead of getting named fields.

Existing tests that pinned old behaviour, now updated in test_pcapng_unit.py:

• the flags dict and the two flags data models gain reserved
• the two unknown-block bodies are now padded
• epb_verdict is dropped from the duplicate-guard list

The 11 new tests are in TestPCAPNGModelling in tests/protocols/misc/test_pcapng_roundtrip2_unit.py. With #1373's three source files written back over this fix, the run reports 12 failed, 9 passed. All 11 new tests fail, along with the ns_dnsname subtest: Latin-1 caf\xe9 was read as café by charset guessing. With the fix, the module reports 19 passed, 7 subtests passed.

Fixture check: all 165 blocks of the six examples/captures/*.pcapng files now rebuild byte-exactly (0 mismatches).

Test results:

• test_pcapng_unit: 97 passed
• test_pcapng_roundtrip_unit: 8 passed
• test_option_roundtrip_unit: 6 passed / 362 subtests
• test_pcapng_regression: 11 passed
• test_pcapng_end_to_end: 6 passed
• test_docstring_contract: 7 passed
• run_unittest_leg.py protocols --exclude protocols/internet: 940 tests, 0 failures
• tests/project: 389 passed, 1 failed (test_isort_clean, an over-long import line). After isort fixed the line, test_isort_clean passes on its own.

[JarryShaw]

Cross-review verdict on e55260826: GOOD TO GO (Sonnet reviewed; author Opus). Reviewed as a delta on #1373.

• All 165 blocks in the six .pcapng fixtures rebuild byte-exactly, 0 mismatches (6, 6, 6, 88, 45, 14 per file). Extraction differs from main only on two profile.pcapng frames, which now read the correct direction and fcs_len because flags are LSB-0.
• fix(pcapng): a big-endian Section Header Block rebuilds little-endian #1272: dhcp_big_endian.pcapng rebuilds, with or without a context, and keyword-built IDB and EPB blocks come out big-endian. fix(pcapng): epb_flags / pack_flags bits are numbered MSB-first, against the spec's LSB numbering #1273: all 32 single bits × 2 byte orders parse and rebuild; positions match pcapng-06 Table 5. fix(pcapng): NRB record names and ns_dnsname are decoded with a guessed encoding #1277: non-UTF-8 NRB names (ff, c3 28, ed a0 80, caf\xe9, truncated 4-byte) all rebuild exactly — the str.split loss from the fix(corekit): StringField is not lossless: guessed charset, U+FFFD substitution, and a character-count length #1336 review is fixed. fix(pcapng): an unknown block type cannot be rebuilt (invalid length) #1278, fix(pcapng): epb_verdict may repeat per the spec, but the builder rejects a second one #1281 (spec: "multiple allowed: yes") and fix(pcapng): WireGuardKeyLog error message is missing its f-string prefix #1286 hold; FieldValueError is a ValueError, so nothing breaks.
• Leg 940/0, tests/project 389 (rerun after the isort fix). The revert proof fails all 11 new tests (13 counting subtests — the body says 12).

Retarget to main after #1373 merges, or its Closes lines will not fire.

Follow-ups filed, both pre-existing: #1382 — an undefined direction or reception value raises, so such a capture cannot round-trip, and bits 9–11 deserve names; #1383 — an NRB name list ending in empty names loses them.

[JarryShaw]

Resolve merge conflicts

[JarryShaw]

Acknowledged, resolving the conflicts. #1373 merged into main, and #1378 was stacked on it, so the branch now conflicts. A worker is rebasing it onto current main and re-running the PCAP-NG legs. The new head will go back to review: pending for a delta review.

[JarryShaw]

Conflicts resolved. The branch still carried #1373's pre-squash commit 68026d540, which duplicates the squashed 0e25f9fe1 on main. The rebase with --onto origin/main 68026d540 dropped it, and #1378's own commit replayed cleanly as 497a3e95c. Nothing had to be resolved by hand.

The verdict carries over. The patch-id is identical across the original e55260826, the rebased 497a3e95c, and the diff of your merge d05e44495 against main, so the review: good-to-go label stays. The PCAP-NG modules and tests/project pass on the rebased tree. I removed the stale "Stacked on #1373" line from the body.

[github-actions]

Coverage: 89.41% (unit tier, Python 3.14, d05e44495, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18791	968	2352	869	90.90%
pcapkit/corekit	2018	88	628	24	94.78%
pcapkit/dumpkit	234	2	84	2	98.74%
pcapkit/foundation	2573	99	910	44	94.63%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	16304	204	4306	166	98.17%
pcapkit/toolkit	539	74	168	3	84.58%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.