[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Description of your pull request and other information

Closes #1566. Closes #1567.

The code change is in pcapkit/foundation/reassembly/ip.py only; no toolkit adapter is touched.

• Oversized datagram (fix(reassembly): an IP datagram over 65,535 octets can read COMPLETE but short, or vanish in strict mode #1566). Both completion checks now go through IP._is_complete, which also requires TDL <= len(datagram). The issue's candidate, (TDL + 7) // 8 <= len(RCVBT), still passes TDL 65,536 as COMPLETE with 65,535 octets. A test covers that case.
• Strict-mode drop (fix(reassembly): an IP datagram over 65,535 octets can read COMPLETE but short, or vanish in strict mode #1566). Strict mode now reports a datagram that has no received run, with payload=(), as lax mode already does.
• Cut non-final fragment (fix(reassembly): IPv6 reassembly zero-fills a snaplen-cut non-final fragment and reports it COMPLETE #1567). Only the final fragment's partial last block is marked received. This replaces fix(reassembly): a TSO fragment's length is its captured length, and RCVBT covers the last block (#1555, #1565) #1564's Total Length 0 case (RFC 791 §3.2, RFC 8200 §4.5). A cut first IPv6 fragment now reads PARTIAL with a hole, under the default (pcap and pcapng), dpkt and scapy engines.
• Clipped fragments. A fragment clipped by the buffer's end still counts as cut there, so 7- and 8-octet non-final fragments at offset 65,528 now agree.
• Changed pins. Two fix(reassembly): IPv4 reassembly raises IndexError for a fragment reaching octet 65,528 #1565 assertions now expect a 1- or 7-octet non-final tail not to be received.

Sample-capture reassembly is byte-identical to main: 9,456 rows across default, dpkt and scapy, in both modes.

[JarryShaw]

Verdict: GOOD TO GO at e8273d9d6. This was a Sonnet cross-review; the author ran Opus. It merges cleanly into current main, and on the merged tree tests/foundation/reassembly gives 126 passed.

• Legitimate datagrams are untouched. The 9,456-row sample dump is identical to main. A seeded differential run of 6,072 cases (3,000 random IPv4/IPv6 datagrams, IHL 20–60, every arrival order, overlap, duplicates, TL 0 up to 100,000 octets) also shows 0 diffs. IPv4 fragments with IP options reassemble byte-exact on all three engines, and tshark agrees.
• The non-final partial-block rule matches Wireshark 4.6.9. It agrees on six crafted IPv4/IPv6 inputs, where main zero-filled the gap case. It also matches Linux: ip_frag_queue trims a non-final fragment to a multiple of 8, and IPv6 rejects one that isn't a multiple of 8.
• payload=() datagrams are safe. to_dict, json.dumps, count/index and the json/plist/tree/pcap dumpers all handle them.
• _is_complete: the issue's own candidate fix still lets TDL 65,536 through as COMPLETE; this PR's bound reads PARTIAL. TL 0 growth stays correct up to 100,000 octets.
• Fail-before: with main's ip.py, 46 tests fail. Reverting one part of the fix at a time gives 31, 8 and 9 failures.
• I re-ran the repro captures myself. The over-65,535 case now reads PARTIAL, and a cut IPv6 first fragment gives runs (56,136) on all three engines.

Non-blocking, filed as #1585 (blocked on this PR):

• No header-aware 65,535 check. A datagram whose header plus TDL exceeds 65,535 (65,523 + 20) still reads COMPLETE. Linux's ip_frag_reasm rejects it.
• Stale _detect_conflicts docstring. It still says a non-final fragment's range is block-aligned, so the octets of an unmarked cut tail record no conflict.

[github-actions]

Coverage: 89.63% (unit tier, Python 3.14, e8273d9d6, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18858	957	2366	871	91.03%
pcapkit/corekit	2334	67	746	35	96.43%
pcapkit/dumpkit	275	3	100	3	98.40%
pcapkit/foundation	2790	154	982	42	93.43%
pcapkit/interface	138	7	52	5	93.68%
pcapkit/protocols	16991	230	4544	191	98.02%
pcapkit/toolkit	708	96	234	6	85.35%
pcapkit/utilities	431	4	124	4	98.56%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.