[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Description of your pull request and other information

Closes #1615.
Closes #1616.

Only ipv4_reassembly in pcapkit/toolkit/dpkt.py changes, plus a new private helper _first_ipv4 next to it.

• fix(toolkit): dpkt gives no IPv4 reassembly input for IPv4 carried in IPv6 #1615: dpkt only looked at the network layer. It now walks through IPv6 to the first IPv4 layer, which is the one frame['IPv4'] finds in the default engine. The walk handles IPv4 directly in IPv6, behind extension headers, and inside 6in6. The IPv4 octets stop at each IPv6 Payload Length above, so a trailer is left out. dpkt gives no input where the default engine dissects no IPv4: a later fragment, more than 32 extension headers (fix(protocols): a chain of ~80+ IPv6 extension headers exhausts recursion and leaves the payload undissected #1604), or a zero Payload Length with no Jumbo Payload option.
• fix(toolkit): dpkt cuts the IPv4 reassembly input at Total Length, truncating the header when it is below the IHL #1616: the input is no longer cut at Total Length. The header is the IHL's octets and the payload is everything after it, as the default engine hands them. The reassembler applies tl - ihl itself.

tests/toolkit/test_dpkt_ipv4_reassembly_input_1615_1616_unit.py checks dpkt's inputs field by field against the default engine's over 21 built cases. It fails without the fix. Disabling the depth bound, the later-fragment check or the short-jumbogram check also turns it red.

pylint: three new C0415, from imports kept inside the helper. mypy: no new errors.

[github-actions]

Coverage: 89.72% (unit tier, Python 3.14, 15c1f1803, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	3	20	3	95.16%
pcapkit/const	18858	954	2366	868	91.06%
pcapkit/corekit	2366	67	760	35	96.48%
pcapkit/dumpkit	275	3	100	3	98.40%
pcapkit/foundation	2884	147	1010	36	94.07%
pcapkit/interface	138	7	52	5	93.68%
pcapkit/protocols	17115	226	4570	191	98.06%
pcapkit/toolkit	957	134	350	6	84.85%
pcapkit/utilities	494	4	146	4	98.75%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Verdict: GOOD TO GO at 15c1f1803.

Sonnet cross-review. It compared every IPv4 reassembly input field and the datagrams, default against dpkt, on 49 chain cases: all 49 match on the PR, while 28 differ on the base. Link layers and 42 truncation cut points also match, and the nested Payload-Length extent was re-derived by hand: 78, then 30, so payload 10 as measured. captured only marks an attached buffer, so ignoring it loses nothing. The TSO tests (#1547, #1555) pass. Of 17 mutants of dpkt.py, 13 are killed; the survivors are redundant or unreachable clauses. I reproduced fail-before myself: 28 passed, then 22 failed on main's dpkt.py.

Non-blocking: two of the three function-local imports could move to module top, which the review checked creates no cycle. I narrowed the body's "any one guard" claim to the three guards the mutants confirm. Out of scope and filed as #1626: dpkt and scapy drop TCP and IPv4 behind some IPv6 chains, such as a Fragment header followed by AH, or Mobility.