[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• fix — corrects a defect

---

Description of your pull request and other information

A Decryption Secrets Block holding a ZigBee NWK or APS key off its fixed width now rebuilds byte-exact. Before, a short key was zero-padded to full width, and secrets_length grew to match. Key octets beyond the fixed width that still fitted inside the block were dropped.

• The data model keeps the key octets exactly as the block holds them in a new data attribute, which is set on parse only. This follows the TLS key-log precedent.
• zigbee_key_held rebuilds the key schema from those octets. A short key packs back short.
• A new trailing field keeps any octets past the fixed width.
• A model built from its fields is still written at full width.

The other secret types (TLS, WireGuard and unknown) already span the whole secrets area, so they are unaffected.

test_pcapng_zigbee_key_width_1986_unit.py covers every short width, long keys, overruns, make→parse and building from fields. It fails on main with 60 failures and passes here.

Two assertions in the #1980 tests pinned the old full-width rebuild, so they now assert a byte-exact one.

Closes #1986

[JarryShaw]

GOOD TO GO at 24656f4ac. A Sonnet review fuzzed 2740 Decryption Secrets Blocks across the NWK, APS, TLS, WireGuard and unknown types:

• every key width from empty to well past the fixed width;
• seven declared secrets_length values, from 0 to a block overrun;
• with and without trailing octets.

Every block rebuilt byte-exact. Pickle, deepcopy, equality and str on the ZigBee models raised nothing, and a model built from fields still writes full width. A parsed model ignores edited key fields on rebuild, as the TLS key log already does; both _make_secrets_* docstrings say so.

The new test fails on main (60 failed) and passes here. The #1980 change corrects an expectation that pinned the old full-width rebuild. All the pcapng, option-roundtrip and public-API test files pass.

[github-actions]

Coverage: 91.54% (unit tier, Python 3.15, 24656f4ac, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19597	881	2618	867	92.11%
pcapkit/corekit	2540	71	808	37	96.54%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2918	23	1016	25	98.78%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17501	222	4612	187	98.13%
pcapkit/toolkit	872	36	298	10	95.21%
pcapkit/utilities	522	2	158	4	99.12%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.