[Muhtasim-Munif-Fahim]

Please follow the guide below

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible

What is the purpose of your pull request?

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Description of your pull request and other information

Fixes #2354

PCAPNG.unpack() overrides Protocol.unpack() but skips its handling of a made header that holds raw octets. So PCAPNG.make(block=<bytes>) packs the bytes verbatim, then read() gets bytes where it expects the block schema, and fails with a bare AttributeError on schema.block.length.

Change (pcapkit/protocols/misc/pcapng.py): at the top of PCAPNG.unpack(), if the made header's block is raw bytes, drop the made header and parse the packed octets the same way a block read from a capture is parsed. Then make(block=<bytes>) builds the block the octets describe. If the octets describe no block (for example b'' or bytes(8)), it raises ProtocolError('PCAPNG: malformed raw block given to make(): ...'). This matches what Protocol.unpack() does for a raw item it cannot parse.

Tests: new tests/protocols/misc/test_pcapng_raw_bytes_block_2354_unit.py (built on the PCAPNGTestCase base from test_pcapng_roundtrip2_unit):

• a DSB given as raw octets parses into a DSB;
• for IDB, EPB and DSB, make(block=<raw octets>) gives the same block as parsing those octets;
• b'' and bytes(8) raise ProtocolError.

Checks run locally:

• isort -l100 -ppcapkit --check-only is clean.
• pylint (Makefile flags) on pcapng.py: same message count as main.
• mypy (Makefile flags) on pcapng.py: same errors as main, with nothing new.
• Unit tier (pytest -n 8 --ignore=tests/integration, runtime/regression excluded): 5299 passed.
  • 35 tests failed. They fail the same way on an unmodified main checkout in my environment (tests/project/test_public_api.py, test_module_isolation.py, and some tests/const and tests/vendor modules). Runtime/regression tiers need the generated sample captures, which I don't have locally.
• All pcapng/make/raw unit tests pass.

Building a DSB from a dict with bytes secrets_data is a separate bug, already covered by #2346, so the tests use hand-built raw octets instead.

AI assistance: this change was prepared with help from an AI coding assistant and reviewed and tested by me before submission.

[JarryShaw]

Review: NEEDS CHANGES at a1266d515 (Sonnet). Thanks for the PR — the core fix is sound, but a few things need addressing before merge.

1. SHB still fails. PCAPNG.make(block=<raw bytes>) for a Section Header Block with ctx=None still raises AttributeError: 'PCAPNG' object has no attribute '_byte', from pack() before your new branch is reached. The changelog/docstring say "every block type," which this contradicts. PCAPNG._byte needs a default (or a getattr fallback) so SHB goes through the same path, with little- and big-endian SHB test cases added.

2. Two comments are now false. The unpack() NOTE ("reached on the parsing path only … a branch that can never be taken") and _check_block_floor's Note ("runs on the parsing path only") are both wrong now that make(block=bytes) reaches them too. Please update both.

3. The new test's module docstring narrates the old defect and repeats "every block type," which isn't true yet (see #1). Reword once SHB is fixed, or scope the claim to what's actually covered.

What I verified independently and holds:

• IDB, PB, SPB, EPB, DSB (several secrets types), custom and unregistered block types all match a real parse of the same bytes, for both byte orders, once a section context is given.
• No regression against the data-model block= path or the existing pcapng test suite (357+50+131 passed across the files I ran).
• Fail-without-fix: 6 failed on origin/main; 3 passed on the head.

Non-blocking notes:

• The fix is lenient — body-only and trailing-junk inputs are accepted with only warnings rather than rejected, which may or may not be what you want; happy to discuss if you'd rather tighten it.
• make()'s docstring for block still only says "Block data." — worth a line on what bytes means there.
• The .rst changelog entry could also cite :pr:2360`` alongside the issue.

[JarryShaw]

Heads up: our own PR #2370 (fix(pcapng): handle make(block=) for a DSB) also closes #2354, covers the DSB case this PR fixes, and is CI-green with no open review findings. If this PR's SHB gap and the conflicts above aren't addressed first, #2370 is likely to land ahead of it — not a reason to stop working on this one, just flagging the overlap.

[JarryShaw]

Closing — the issue this targets (#2354) is already resolved on main by our own #2370, which merged and covers the same raw-bytes-block case. Thanks for the work here; nothing wrong with the approach, it's just been superseded.