[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A, centralised in chore(docs): centralise changelog entries for unreleased versions #2483

What is the purpose of your pull request?

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else
• const — regenerates constant or registry tables, members keeping their numeric values

---

Description of your pull request and other information

Closes #2510.

• LinuxSLL owns a __proto__ keyed by ARPHRD, listed in enum-value order: FRAD, IPGRE/IP6GRE → GRE, IEEE80211_RADIOTAP → Radiotap (feat(link): add a radiotap dissector for IEEE80211_RADIOTAP on LinuxSLL #2509), NETLINK. It declares __proto_key__ = (ARPHRD, False). The _ARPHRD_NOT_ETHERTYPE branch chain is gone; it never shipped.
• __index__ now returns FRAD → ARPHRD.FRAD, GRE → ARPHRD.IPGRE (both keys registered) and Netlink → ARPHRD.NETLINK.
• LinuxSLL, FRAD and Netlink each get their own register override, and register_arphrd, register_frad and register_netlink join the link-layer section of foundation.registry.protocols.
• Dispatch is unchanged: a probe of 7 arphrd cases × 3 stop settings gives byte-identical output before and after. The new tests fail on main.

Open questions are below; the Sonnet review is in flight.

• register_frad and register_netlink validate with _check_code(code, None, target), and _check_number is gone (refactor(link): dispatch LinuxSLL's non-EtherType ARPHRD values through its own registry (#2510) #2527 Q5, after feat(registry): foundation.registry wrappers for IPX and SCTP sub-maps; record the convention (#2511) #2521).

[JarryShaw]

Decisions needed (the conventions do not settle these):

1. Stop handling. On main, a parse told to stop at LinuxSLL still dispatches FRAD/GRE/Netlink (protocol='LinuxSLL2' on a FRAD frame gives LINUX_SLL2:FRAD:IPv4:UDP). This PR keeps that parity. Options: keep it, or honour the stop in its own issue. Recommendation: keep it here and file the stop fix separately.
2. EtherType path. The ruling said to hand EtherTypes to super()._import_next_layer. Once LinuxSLL owns __proto__, though, super() would look EtherTypes up in the ARPHRD map, so this path names Link.__proto__ directly, as FRAD does for SNAP. One side effect: LinuxSLL.register now registers ARPHRD keys, where it used to register EtherTypes through Link. Options: accept, or restructure. Recommendation: accept, and label this breaking if that register change counts as public contract.
3. GRE.__index__ returns ARPHRD.IPGRE, the lower of its two keys. Recommendation: keep.
4. Wrapper naming. register_arphrd takes its name from the key enum, as register_ethertype does, while register_frad/register_netlink take the owner's name, as register_tcp does, because their keys have no enum. Recommendation: write that rule into refactor(registry): every class-level registry map gets its foundation.registry wrapper #2511's convention section.
5. The bare-int key check (_check_number, which Loopback in feat(registry): foundation.registry wrappers for IPX and SCTP sub-maps; record the convention (#2511) #2521 needs as well). Options: (a) keep it local; (b) fold it into _check_code as kind=None once feat(registry): foundation.registry wrappers for IPX and SCTP sub-maps; record the convention (#2511) #2521 lands. Recommendation: (b).
6. ARPHRD.__proto_dest__, which would let code=ARPHRD.X infer LinuxSLL. Recommendation: a follow-up issue, since it regenerates a const module.

[JarryShaw]

Cross-review (Sonnet) at 30aabb248: NEEDS CHANGES, for wording only. Code, dispatch and registry behaviour all held up. 13,824 combinations matched origin/main byte for byte: LinuxSLL1/2, every ARPHRD value plus extras, 8 protocol_type values, 8 payload shapes and 9 stop settings. 540 round trips also match, and Link.__proto__, FRAD.__proto__ and the name registry are unchanged. Without the fix, 13 of the new module's 17 tests fail.

Required:

• L2TPv2.__index__'s docstring claims every non-raising __index__ returns a TransType, EtherType or LinkType, and this PR makes that false.
• LinuxSLL.register's docstring narrates the change ("no longer has its protocol_type read as an EtherType").

Recommended: drop the count in GRE.__index__'s docstring. The fix round is running; it is pushed once queued runs drop below 20.

[JarryShaw]

drop the count.

[JarryShaw]

Owner: drop the count in GRE.__index__'s docstring. That is already in this PR's fix round, alongside the two required wording fixes. Q1 to Q6 in the decision comment above (stop handling, the EtherType path, GRE.__index__, wrapper naming, the bare-int check, ARPHRD.__proto_dest__) are still open, so needs: decision stays.

[JarryShaw]

take all your recommendations on Q1-6

[JarryShaw]

Owner took all six recommendations, paraphrased and reconciled:

1. Stop handling keeps main's behaviour here; the fix is fix(link): a parse told to stop at LinuxSLL still dispatches FRAD, GRE and Netlink #2532.
2. The EtherType path naming Link.__proto__ is accepted. LinuxSLL.register now takes ARPHRD keys and refuses EtherTypes, and LinuxSLL shipped in 1.5.1, so this PR is now labelled breaking.
3. GRE.__index__ stays ARPHRD.IPGRE.
4. The wrapper naming rule (named after the key enum, or after the owning protocol for bare-int keys) goes into registry-protocol.rst via feat(registry): foundation.registry wrappers for IPX and SCTP sub-maps; record the convention (#2511) #2521's fix round.
5. _check_number folds into _check_code(kind=None) once feat(registry): foundation.registry wrappers for IPX and SCTP sub-maps; record the convention (#2511) #2521 lands with that helper. That becomes a follow-up commit here.
6. ARPHRD.__proto_dest__ is feat(const): ARPHRD declares __proto_dest__ so code=ARPHRD.X infers LinuxSLL #2533.

The wording fix round requested by the review is still running; it is pushed once queued runs drop below 20.

[JarryShaw]

Fix round at e2b30f2e3, cross-reviewed (Sonnet): GOOD TO GO. It rewrites the docstrings the review flagged:

• L2TPv2.__index__ lists ARPHRD among its return types;
• LinuxSLL.register states current behaviour, not a version comparison;
• GRE.__index__ names IP6GRE without counting keys.

Q5 (folding _check_number into _check_code(kind=None)) follows here once #2521 lands.

[github-actions]

Coverage: 93.95% (unit tier, Python 3.15, e2b30f2e3, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	20087	144	2710	125	98.78%
pcapkit/corekit	2605	74	818	37	96.52%
pcapkit/dumpkit	281	3	100	3	98.43%
pcapkit/foundation	3232	27	1128	31	98.67%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	19935	213	5244	207	98.32%
pcapkit/toolkit	924	36	334	10	95.55%
pcapkit/utilities	502	7	144	5	98.14%
pcapkit/vendor	5009	2222	1148	182	52.31%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Rebased onto main after #2509 and #2521 merged: e2b30f2e3 → c271988f3. There are three commits; the first two are the old two, re-applied.

• Resolution, semantic: feat(link): add a radiotap dissector for IEEE80211_RADIOTAP on LinuxSLL #2509's hand-written radiotap branch in LinuxSLL._import_next_layer becomes a LinuxSLL.__proto__ entry, IEEE80211_RADIOTAP → Radiotap. Radiotap.__index__ returns its ARPHRD entry, as FRAD, GRE and Netlink do. feat(registry): foundation.registry wrappers for IPX and SCTP sub-maps; record the convention (#2511) #2521's register_loopback and the registry tests are kept alongside refactor(link): dispatch LinuxSLL's non-EtherType ARPHRD values through its own registry (#2510) #2527's wrappers.
• Outside the resolved files the patch-id is unchanged (d67832a4c560).
• New commit (Q5): register_frad and register_netlink use _check_code(code, None, target), and _check_number is deleted. Their messages are identical on 30 inputs.
• Checks: 42 of 42 dispatch checks pass, and every round trip is byte-exact. CI on the old head was green.
• Review: the resolution is not mechanical, so the label goes to review: pending and a re-review is dispatched.
• Known red, also on main: test_registry_wrapper_coverage_2511_unit fails on Radiotap.__proto__. A test-only fix to main is in progress.

[JarryShaw]

Re-review (Sonnet) at c271988f3: GOOD TO GO.

• Dispatch: a 73,600-row harness over LinuxSLL1/2, 23 ARPHRD values, 10 protocol types, 16 payload shapes and 10 stop settings is byte-identical on the head and on main. Radiotap frames parse as LINUX_SLLn:Radiotap:Raw with exact round trips, and FRAD, GRE and Netlink and the truncated-FRAD Raw are unchanged.
• Mutations: pointing radiotap's entry back at Raw, or breaking Radiotap.__index__, fails tests.
• Q5: _check_code(.., None, ..) matches _check_number on all 52 code/target pairs, and no reference remains.
• Nothing lost: none from feat(link): add a radiotap dissector for IEEE80211_RADIOTAP on LinuxSLL #2509 or feat(registry): foundation.registry wrappers for IPX and SCTP sub-maps; record the convention (#2511) #2521. The PR adds no member-order finding.
• Known red: the radiotap wrapper-coverage failure is identical on main, which has a test-only fix in progress.
• Non-blocking: registry-protocol.rst's Registration Wrappers names only IPX and Loopback as overriding register; LinuxSLL, FRAD and Netlink do too.

[JarryShaw]

Correction to my reconciliation above: LinuxSLL did not ship in 1.5.1. The v1.5.1 tag has no linux_sll module, and the commit that added it is not an ancestor of the tag. So LinuxSLL.register changing to ARPHRD keys alters no released contract, and I have removed the breaking label. The central changelog will list this change as non-breaking.