From 5d2d6808747ed8ecfb7fdee64df2e0497a981835 Mon Sep 17 00:00:00 2001
From: Clinton Thomas <1033162+KernelClint@users.noreply.github.com>
Date: Fri, 2 Oct 2026 16:07:52 -0400
Subject: [PATCH] tests: check that open_pcap returns only the captured bytes

The GHSA-c547 test checks the header lengths but not the data that
next() returns, so it still passed with the fix reverted.

AI-Assisted: yes
---
 test/regression.uts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/test/regression.uts b/test/regression.uts
index 1807df69758..fa7e806820c 100644
--- a/test/regression.uts
+++ b/test/regression.uts
@@ -297,10 +297,12 @@ try:
     # 1. Open with libpcap
     reader = open_pcap(fname, offline=True)
     # 2. Read packet
-    reader.next()
+    _, data = reader.next()
     # 3. Check the header lengths
     assert reader.header.contents.len == 1034
     assert reader.header.contents.caplen == 34
+    # 4. Only the captured bytes are returned (GHSA-c547-xwrv-q9jm)
+    assert data == raw(pkt)
 finally:
     try:
         reader.close()