[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in chore(docs): centralise changelog entries for unreleased versions #2483

What is the purpose of your pull request?

• fix — corrects a defect

---

Description of your pull request and other information

MH mobility options that did not round-trip after a one-octet change now either rebuild byte for byte or are refused. A refused option is kept as Raw inside IPv6, which rebuilds exactly and logs nothing.

• Length mismatch: a shared check refuses an option or sub-option whose fields don't take exactly its declared length. This covers MN-ID length 0, LCMP and ANI sub-option lengths, CGA extensions, and retyped options 13→12 and 42→0.
• Prefix length: options 30, 36, 37 and 55 check it against the field's width only (6 or 8 bits). A parsed, hand-built and keyword value are treated alike, so anything that parses also builds.
• Text identifiers: Service Selection and MN-ID NAI count the octets they write back, not re-encoded text.
• QoS: the 2 reserved traffic-class bits are kept, in a new tc_reserved field.

Breaking: QualityOfServiceOption gains the required field tc_reserved.

• CGA Parameters: the key's DER long-form length is decoded, so a real 1024-bit RSA key now parses. A key or fixed fields that run past the option are refused before they over-read.

The tests include a one-octet mutation sweep over every option code MH.__option__ knows, and it fails on main. Shipped captures parse identically to main, apart from the QoS frame gaining tc_reserved: 0.

Closes #2684

[JarryShaw]

NEEDS CHANGES at 87a01720f, from a Sonnet cross-review. The shared length check, the text identifiers, tc_reserved and the CGA long form are confirmed. Every cut inside IPv6 still rebuilds through the built-in short read, and the sweep shows no mismatches. Two changes:

1. The prefix-length exemption lets a caller-built model through for options 30, 36, 37 and 55, which is refactor(protocols)!: refuse fixed-size octets and timestamp counts the makers masked (#2676) #2691's defect class: a hand-built model with a prefix length of 40 or 63 is written, and option 55 accepts 200. Check the prefix length only against the wire width, so whatever parses also builds and no exemption is needed. If the data model cannot hold such a value, refuse it on parse, kept quiet as Raw.
2. tc_reserved is a new required field, which breaks direct construction of the QoS model. Give it a default of 0, or mark the PR breaking with a ! subject.

[JarryShaw]

The fix round is ready at faa02c75e. Its push is held because the Actions queue is at 56, and fix rounds wait for fewer than 40.

[JarryShaw]

GOOD TO GO at faa02c75e, rebased onto be8306140. I checked the delta myself.

• Prefix length: the data-model exemption is gone. Options 30, 36, 37 and 55 check the prefix length against its field width only, so hand-built and parsed models are treated alike. A new test pins that.
• tc_reserved: it stays a required field, because data models generate constructors with no defaults. The PR is therefore breaking, with a ! subject.