[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort) — ran the tools on tcp.py only: mypy 0 errors, pylint no new messages (5 fewer); isort's complaint on tcp.py/test_tcp_udp_unit.py is already on main
• make test passes, and a test case covers the change — the 17 tests/protocols/transport/test_tcp*/test_transport_unit modules, test_option_roundtrip_unit, and tests/project, each run on its own
• Added a changelog entry — N/A, added centrally after the wave

What is the purpose of your pull request?

• fix — corrects a defect

---

Description of your pull request and other information

Closes #1151. _make_tcp_options dropped the NOP/EOOL options it was given and padded each option to 4 octets separately. Now it emits options as given and pads once at the end: zero octets after a trailing EOOL, otherwise NOPs then an EOOL.

Probe: parse each TCP segment, TCP.from_data(info), compare header octets. The payload maker is stubbed so the HTTP rebuild (#1154) does not interfere.

capture	before	after
http.pcap	0/1117	1117/1117
http6.cap / test.pcap	0/26, 0/32	26/26, 32/32
many_interfaces.pcapng / tcp.pcap / stream.pcap	0/32, 0/7, 0/5	all

http.pcap before: a002…0402080a…01030306 → b002…040201 00 080a…0100 030306 00. options-*.pcap regenerate byte-identical.

New test file tests/protocols/transport/test_tcp_options_roundtrip_unit.py: 4 passed with the fix, 4 failed without it. test_tcp_udp_unit.py pinned the old NOP-dropping behaviour and is updated. EXPECTED_FAILURES had no TCP entries, so it is unchanged.

[JarryShaw]

Cross-review verdict on 5b3c5ad9a: GOOD TO GO (ran on Sonnet; author Opus). Also labelled breaking: this changes the pack path.

• Root cause confirmed: on main, TCP(options=[WindowScale(7), MSS(1460)]) packs 03030700 020405b4. The EOOL after WindowScale ends option parsing, so the MSS is hidden. I re-ran this myself. The PR packs 030307020405b400. On main, rebuilt headers carry a mid-list EOOL 222 times in http.pcap and 4 times each in http6.cap, test.pcap and many_interfaces.pcapng; with the PR there are none.
• Byte-exact header rebuilds: 1117/1117 http.pcap, 26/26 http6.cap, 32/32 test.pcap, 32/32 many_interfaces.pcapng, 7/7 tcp.pcap and 5/5 stream.pcap, against 0 on main. options-*.pcap regenerate byte-identical.
• Padding: follows RFC 9293 §3.1. Across 600 fuzzed option lists, data_offset*4 == len(header) held and every list re-parsed cleanly.
• Edited assertions in test_tcp_udp_unit.py: they pinned a defect recorded by the bulk commit 78e28d811.
• Fails without the fix: 8 failed. With fix(http): HTTP.from_data raises 'invalid HTTP version: 0' #1162 merged alongside, a full TCP.from_data round trip with payload gives 1117/1117 byte-exact http.pcap segments.
• Follow-up, not in this diff: examples/generators/options.py:1606-1617 still says NOP/EOOL are dropped by _make_tcp_options. That is now false, though the SKIP entries still work.

[github-actions]

Coverage: 88.86% (unit tier, Python 3.14, 5b3c5ad9a, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18757	1034	2342	845	90.24%
pcapkit/corekit	1878	91	580	22	94.34%
pcapkit/dumpkit	142	0	42	0	100.00%
pcapkit/foundation	2422	104	842	40	94.24%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	15674	188	3950	163	98.18%
pcapkit/toolkit	487	65	144	1	85.42%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2359	1006	158	42.84%

Per-file detail: the coverage-html artifact of this run.