[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort) — not run
• make test passes, and a test case covers the change — ran the new module plus test_ipv4_unit, test_ipv6_unit, test_tcp_udp_unit, test_udp_runtime, tests/project
• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A, added centrally after the wave

What is the purpose of your pull request?

• fix — corrects a defect

---

Description of your pull request and other information

Closes #1155, per the maintainer's ruling: on a truncated capture from_data keeps each length field as it was on the wire.

IPv4.make, UDP.make and IPv6.make computed the length from the payload handed to them, so a rebuild wrote the recorded length. Each now takes it explicitly — total_length for IPv4/UDP, payload_length for IPv6 — and _make_data passes the parsed one through. Omitting it computes as before, so IPv4(payload=...) is unchanged.

Public make() behaviour: additive only. A new optional keyword, appended before payload, with the old computation as its default; no existing call changes its output. Not a breaking change. _make_data gains a key, which is why three existing hand-built data stubs needed the field added (test_ipv4_unit, test_ipv6_unit, test_tcp_udp_unit — the UDP edit is two lines and does not touch the TCP options assertions).

Probe, X.from_data(x.info).data == x.data on the truncated frames:

frame	before	after
big_endian.pcap #3 IPv4	450004a2… → 45000052…	matches
big_endian.pcap #3 UDP	048e → 003e	matches
big_endian_nanosecond.pcap, little_endian.pcap	same	matches

Over all of examples/captures/, header-isolated: IPv4 mismatches 4 → 1, UDP 8 → 1, IPv6 0 → 0, with no new mismatches. The one remaining case is test.pcapng frame 3, cut inside the IPv4 header (18 of 20 octets), so UDP was parsed from zero bytes and its whole header is fabricated — a separate defect, not this one; the declared 300 is now preserved and the rebuilt prefix matches the 18 captured octets.

Reverting the fix: 11 failed, 4 passed, 39 subtests passed. With it: 6 passed, 48 subtests passed.

[github-actions]

Coverage: 88.87% (unit tier, Python 3.14, 41a67cc18, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18757	1035	2342	846	90.23%
pcapkit/corekit	1878	91	580	22	94.34%
pcapkit/dumpkit	142	0	42	0	100.00%
pcapkit/foundation	2422	104	842	40	94.24%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	15710	188	3980	165	98.18%
pcapkit/toolkit	487	65	144	1	85.42%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2359	1006	158	42.84%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Cross-review verdict on 41a67cc18: GOOD TO GO (ran on Sonnet; author Opus). Also labelled breaking, because the pack path changes.

• Root cause confirmed: on main, IPv4.make writes ihl * 4 + len(payload) (ipv4.py:435) and UDP.make writes 8 + len(payload) (udp.py:200). A truncated capture therefore rebuilds with a shorter length: 04a2→0052 and 048e→003e on frame 3 of big_endian*.pcap and little_endian.pcap. Merged with main, all three rebuild byte-exact.
• Sweep, with main merged in: header mismatches drop from 230 to 1 for IPv4, 8 to 1 for UDP, and 189 to 0 for IPv6, with zero new mismatches. The PR body's 4/8/0 understated the improvement. The one remaining case is test.pcapng frame 3; see below.
• Default path unchanged: a 300-case fuzz of fresh make() builds with no length keyword is byte-identical to main.
• No collisions or positional callers: every .make( in pcapkit/ goes through **kwargs, and the IPv4 local was cleanly renamed to options_length.
• Why breaking: from_data no longer recomputes lengths, which is what the ruling asked for. The new parameter also sits before payload and is not keyword-only, so a positional UDP.make(..., payload) call would shift. Nothing in the repo calls it that way.
• Fails without the fix: 11 tests fail. The edited stubs only add the new key.
• Follow-up, not this PR: test.pcapng frame 3 is cut at 18 of 20 IPv4 header octets. The rebuild then fabricates a full 8-octet UDP header from an empty, all-zero parse. Filed as fix(protocols): a capture cut inside the IPv4 header rebuilds with a fabricated UDP header #1167.