ja4plus 1.2.1__tar.gz → 1.2.2__tar.gz

{ja4plus-1.2.1 → ja4plus-1.2.2}/.github/workflows/docs.yml

@@ -120,4 +120,4 @@ jobs:
         # default that version 4 gave them, and `page_url` stays the one output. The
         # runtime moves from `node20` to `node24`.
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128  # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346  # v5.0.1

{ja4plus-1.2.1 → ja4plus-1.2.2}/CHANGELOG.md

@@ -6,6 +6,24 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+- **The QUIC CRYPTO reader stops at the first byte that has not arrived** (#762).
+  Round
+  267. **An outside reporter measured the defect on Windows against a live capture.**
+  `reassemble_crypto_fragments` allocated a buffer to the highest fragment end, and each gap
+  read as zero bytes. **A ClientHello whose tail arrived before its middle passed the length
+  check**, and the TLS reader parsed the zero bytes as extension type 0. The reader now
+  returns the bytes from offset 0 to the first gap, which its docstring already stated. The
+  change reaches the ClientHello path, the ServerHello check and the JA4S reader.
+  `tests/test_quic_crypto_gap.py` replays the fragment layout of the report against the
+  ClientHello of `quic-with-several-tls-frames.pcapng`. **Before the repair the first
+  datagram wrote `q12d032700_55b375c5d22e_c65986f5733c`**, and after it the first datagram
+  writes nothing and the second writes the FoxIO value. **A replay of all 38 committed
+  captures writes 788 values at version 1.2.1 and 788 here, byte-identical.** The dependency
+  reader cases of `tests/test_documentation_site.py` now compare distribution names (#768),
+  so a pin bump fails no case there. Three pins of the `dev` and `docs` extras move: `build`
+  1.6.1, `ruff` 0.16.9 and `mkdocstrings-python` 2.0.9 (#764, #766, #767). **The conformance
+  suite reports 1684 passed, 142 skipped and 138 xfailed before this round and after it.**
+
 - **Every live prose of the repository takes the US spelling** (#663).
   Round
   266. **The maintainer ruled on 2026-08-16, and rule 17 of `.claude/rules/ste.md` records
@@ -2069,6 +2087,32 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   **No file under `ja4plus/` changes and no fingerprint moves**, and the conformance suite
   reports 1635 passed, 143 skipped and 140 xfailed.
 
+## [1.2.2] - 2026-09-29
+
+Version 1.2.2 follows version 1.2.1, and no version stands between them. The date of the
+heading above is the date this release reaches `master`. It carries round 267.
+
+**The bump is patch and never minor.** This release adds no published name, it removes
+none, and it renames none.
+
+**One reader stops producing a wrong value.** The QUIC CRYPTO reader filled each gap
+between fragments with zero bytes (#762). Where a ClientHello arrived out of order across
+datagrams, and its last fragment arrived before a middle one, the reader parsed the zero
+bytes and wrote a JA4 value that describes no traffic. **The reader now waits for every
+byte**, and it writes the correct value when the gap fills. The same reader serves the
+ServerHello check and the JA4S reader, so each one waits in the same way.
+
+**No value of the committed corpus moves.** A replay of all 38 committed captures writes
+788 values at version 1.2.1 and 788 here, and the two dumps are byte-identical. No committed
+capture carries a CRYPTO gap. **A caller whose traffic carried such a gap sees a wrong JA4
+value go away, and the correct one takes its place.**
+
+**The conformance suite holds its reading.** It reports 1684 passed, 142 skipped and 138
+xfailed at version 1.2.1 and here.
+
+**Three pins of the `dev` and `docs` extras move**, and no runtime dependency moves: `build`
+1.6.1, `ruff` 0.16.9 and `mkdocstrings-python` 2.0.9.
+
 ## [1.2.1] - 2026-08-16
 
 Version 1.2.1 follows version 1.2.0, and no version stands between them. The date of the

{ja4plus-1.2.1 → ja4plus-1.2.2}/CLAUDE.md

@@ -4,7 +4,7 @@
 produces JA4+ fingerprints. FoxIO publishes the JA4+ standard. This project is an
 independent implementation of it.
 
-This repository declares version 1.1.1, and `ja4plus/__init__.py:101` holds that one
+This repository declares version 1.2.2, and `ja4plus/__init__.py:101` holds that one
 declaration. A publish to PyPI is a separate step, and the maintainer runs it.
 
 Design lives in `docs/specs/`. Read `docs/specs/spec.md` and the relevant

{ja4plus-1.2.1/ja4plus.egg-info → ja4plus-1.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ja4plus
-Version: 1.2.1
+Version: 1.2.2
 Summary: JA4+ network fingerprinting library for TLS, TCP, HTTP, SSH, X.509, and DHCP analysis
 License: BSD-3-Clause AND LicenseRef-FoxIO-1.1
 Project-URL: Homepage, https://github.com/Crank-Git/ja4plus
@@ -29,9 +29,9 @@ Requires-Dist: cryptography>=42.0.0
 Provides-Extra: dev
 Requires-Dist: pytest==9.1.1; extra == "dev"
 Requires-Dist: pytest-cov==7.1.0; extra == "dev"
-Requires-Dist: ruff==0.16.2; extra == "dev"
+Requires-Dist: ruff==0.16.9; extra == "dev"
 Requires-Dist: mypy>=1.11; extra == "dev"
-Requires-Dist: build==1.5.0; extra == "dev"
+Requires-Dist: build==1.6.1; extra == "dev"
 Requires-Dist: twine==7.0.0; extra == "dev"
 Provides-Extra: lookup
 Requires-Dist: requests>=2.20.0; extra == "lookup"
@@ -39,8 +39,8 @@ Provides-Extra: docs
 Requires-Dist: mkdocs==1.6.1; extra == "docs"
 Requires-Dist: mkdocs-material==9.7.7; extra == "docs"
 Requires-Dist: mkdocstrings==1.0.6; extra == "docs"
-Requires-Dist: mkdocstrings-python==2.0.5; extra == "docs"
-Requires-Dist: griffe==2.1.0; extra == "docs"
+Requires-Dist: mkdocstrings-python==2.0.9; extra == "docs"
+Requires-Dist: griffe==2.3.0; extra == "docs"
 Dynamic: license-file
 
 <p align="center"><img src="assets/logo.png" width="300"></p>

{ja4plus-1.2.1 → ja4plus-1.2.2}/docs/migration-0.6-to-1.0.md

@@ -3,7 +3,7 @@
 Where `ja4plus --version` reports 0.6.0, read this page before you install version 1.0.0.
 That command names the version of the package your environment holds.
 
-This repository declares version 1.2.1, which is a patch release of version 1.2.0.
+This repository declares version 1.2.2, which is a patch release of version 1.2.1.
 **Python 3.9 leaves the supported set at version 1.1.0**, and version 1.0.1 is the release
 that still installs on it. Version 1.1.0 moves no other interface and no fingerprint, and
 version 1.1.1 repairs one crash of the ServerHello reader and moves neither.
@@ -13,7 +13,9 @@ rows below state what version 1.0.0 changed against version 0.6.0, and version 1
 changes none of them, so every row reads the same here. **Version 1.2.1 moves no
 fingerprint value at all**, so it breaks no row either. It repairs the address pair the
 command prints for a value that no packet released, and it moves the frame that carries
-the QUIC `JA4L-S` value without moving the text of that value. **A reader who moves from version
+the QUIC `JA4L-S` value without moving the text of that value. **Version 1.2.2 moves no
+value of the committed corpus either**, so it breaks no row. It stops the QUIC ClientHello
+reader at the first CRYPTO byte that has not arrived (#762). **A reader who moves from version
 1.1.1 rather than from version 0.6.0 reads the `## [1.2.0]` section of `CHANGELOG.md`
 instead**, which names each value that moves and the issue that carries it. Those values
 are JA4X and JA4H on an empty list, JA4TS on a reset of a one-SYN-ACK connection, JA4T on

{ja4plus-1.2.1 → ja4plus-1.2.2}/docs/specs/spec.md

@@ -971,6 +971,7 @@ RST of a connection that holds one SYN-ACK. Four counts make the 68.
 | 264 | 2026-08-16 | Batch #731 recorded the last five ruled questions of the divergence register, and no member moved a fingerprint value. **#714 cited the JA4 transcription in the empty-list sentinel row.** **#622 recorded the JA4L timing fork as permanent**, because FoxIO publishes four readings that split two against two. **#625 recorded that point `B` stays the Initial packet that completes the ServerHello**, and the ruling of 2026-08-16 superseded the reason of the 2026-08-15 ruling and kept the outcome: the four references state four mechanisms, which is a plurality and no majority. **#621 kept the decryption non-goal of #129 and replaced the reversal condition**, because the earlier condition fired in form and not in substance. The new condition requires a release of the port that carries the capability, and a re-measurement of the yield against the 138 keys and 38 captures of this project. **#593 declined the eight key-material names of the port** under that same condition. **It corrected two stale premises of its own issue body**: the port pins `github.com/gopacket/gopacket v1.7.1`, which reads block type 10 at `pcapgo/pcapng.go:43`, and `scapy` reads a Decryption Secrets Block at `scapy/utils.py:1645`, so this project carries no reader gap. **The sub-merge of `dev` repaired six citations that #606 moved, across two rows.** The #625 row moved to `ja4plus/fingerprinters/ja4l.py:580-623`, `:614-615`, `:618` and `:620-622`, and it names the new emission site at `ja4plus/fingerprinters/ja4l.py:689`. The #622 row moved to `ja4plus/fingerprinters/ja4l.py:580-623` and `:621`. **The batch review measured that count**, because the record first stated three. **This is the first round one batch records under the model of #727**, and no member wrote a record of its own. The conformance suite reported 1676 passed, 142 skipped and 138 xfailed before the batch and after it. |
 | 265 | 2026-08-16 | Batch #738 read four guards, and no member moved a fingerprint value. A replay of all 38 committed captures wrote 788 values before the batch and 788 after it, byte-identical. **#736 measured that the conformance suite discriminates no emission frame move**, because only the FoxIO Wireshark dissector states the frame that carries a value, on all 724 values of 26 files. The FoxIO Python expected output, the FoxIO Rust snapshots and the seven Zeek baselines each state none. `.claude/rules/conformance.md` records what a green conformance run does not measure, and it names the seven frame moves of #606. **#720 states that a report an agent did not return is reported as absent.** A census of 1842 records found one that carries the shape, which is the record #720 was filed for. **No case refuses the shape**, because a case would need the session transcript and git tracks no copy of it, so `.claude/rules/agent-reports.md` states that rather than ships a guard that guards nothing. **#697 gives `get_stream` the byte-cap truncation the port holds**, under parity rule 2, and the truncation removes no byte today. **#742 repairs a user-visible output no guard could read**: `Processor.close_open_windows` dropped the four endpoint fields, so the command printed `unknown` for 22 of the 28 values that reach that path. **The loss sat downstream of every guard**, because each one read an entry that carried the correct pair. |
 | 266 | 2026-08-16 | The maintainer ruled US English on 2026-08-16, and rule 17 of `.claude/rules/ste.md` records it. **The prose of this repository is largely agent-written**, so a worker that matched the surrounding spelling strengthened a convention no person chose. **The sweep of #663 found 282 matches across 48 files and moved 109 words across 55 files**: 59 of `docs/`, 38 of `tests/`, 8 of `.claude/rules/`, 2 of `ja4plus/`, one of `CLAUDE.md` and one of `README.md`. **A record moved nowhere.** `CHANGELOG.md` holds 33 matches and the change set holds no line of it, and every hunk of `docs/specs/spec.md` stands above the `## Changelog` table. **No identifier moved and no name a caller reads moved.** `## Behaviour rules` stays because a case reads that heading by string, the seven `NEIGHBOUR` constants stay, and 26 occurrences of `acknowledgement` stay because American English holds that form. **`tests/test_us_english_spelling.py` reads every exemption from the rule file** rather than from a list it keeps itself. The conformance suite reported 1684 passed, 142 skipped and 138 xfailed before this round and after it. |
+| 267 | 2026-09-29 | #762 landed and the QUIC CRYPTO reader stops at the first byte that has not arrived. **The reader filled each gap with zero bytes**, so a ClientHello whose tail arrived before its middle passed the length check and wrote a wrong JA4 value. `tests/test_quic_crypto_gap.py` replays the reported layout against the ClientHello of `quic-with-several-tls-frames.pcapng`. **A replay of all 38 committed captures wrote 788 values before the round and 788 after it, byte-identical.** #768 made the dependency reader cases compare distribution names, and #764, #766 and #767 moved three pins of the `dev` and `docs` extras. Version 1.2.2 carries this round. |
 
 ## Issue map
 

{ja4plus-1.2.1 → ja4plus-1.2.2}/ja4plus/__init__.py

@@ -98,7 +98,7 @@ def compute_ja4x_from_pem(cert_pem_bytes: bytes | str) -> str | None:
 #
 # **Keep the plain string assignment.** `setuptools` reads the value from the syntax tree,
 # so a computed value would make a build import this module and every dependency it loads.
-__version__ = "1.2.1"
+__version__ = "1.2.2"
 __author__ = "ja4plus contributors"
 __license__ = "BSD-3-Clause"
 

{ja4plus-1.2.1 → ja4plus-1.2.2}/ja4plus/utils/quic_utils.py

@@ -329,11 +329,15 @@ def reassemble_crypto_fragments(fragments: Iterable[tuple[int, bytes]]) -> bytes
     if not by_offset:
         return b""
 
-    sorted_frags = sorted(by_offset.items())
-    total_len = max(off + len(data) for off, data in sorted_frags)
-    buf = bytearray(total_len)
-    for off, data in sorted_frags:
-        buf[off : off + len(data)] = data
+    # The reader returns the bytes from offset zero up to the first unreceived byte. A
+    # buffer that reached the highest offset held each gap as zero bytes, and a length
+    # check reads those as received. #762 measured a ClientHello whose tail arrived
+    # before its middle: the TLS reader parsed the zero bytes and produced a wrong JA4.
+    buf = bytearray()
+    for off, data in sorted(by_offset.items()):
+        if off > len(buf):
+            break
+        buf.extend(data[len(buf) - off :])
     return bytes(buf)
 
 

{ja4plus-1.2.1 → ja4plus-1.2.2/ja4plus.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ja4plus
-Version: 1.2.1
+Version: 1.2.2
 Summary: JA4+ network fingerprinting library for TLS, TCP, HTTP, SSH, X.509, and DHCP analysis
 License: BSD-3-Clause AND LicenseRef-FoxIO-1.1
 Project-URL: Homepage, https://github.com/Crank-Git/ja4plus
@@ -29,9 +29,9 @@ Requires-Dist: cryptography>=42.0.0
 Provides-Extra: dev
 Requires-Dist: pytest==9.1.1; extra == "dev"
 Requires-Dist: pytest-cov==7.1.0; extra == "dev"
-Requires-Dist: ruff==0.16.2; extra == "dev"
+Requires-Dist: ruff==0.16.9; extra == "dev"
 Requires-Dist: mypy>=1.11; extra == "dev"
-Requires-Dist: build==1.5.0; extra == "dev"
+Requires-Dist: build==1.6.1; extra == "dev"
 Requires-Dist: twine==7.0.0; extra == "dev"
 Provides-Extra: lookup
 Requires-Dist: requests>=2.20.0; extra == "lookup"
@@ -39,8 +39,8 @@ Provides-Extra: docs
 Requires-Dist: mkdocs==1.6.1; extra == "docs"
 Requires-Dist: mkdocs-material==9.7.7; extra == "docs"
 Requires-Dist: mkdocstrings==1.0.6; extra == "docs"
-Requires-Dist: mkdocstrings-python==2.0.5; extra == "docs"
-Requires-Dist: griffe==2.1.0; extra == "docs"
+Requires-Dist: mkdocstrings-python==2.0.9; extra == "docs"
+Requires-Dist: griffe==2.3.0; extra == "docs"
 Dynamic: license-file
 
 <p align="center"><img src="assets/logo.png" width="300"></p>

{ja4plus-1.2.1 → ja4plus-1.2.2}/ja4plus.egg-info/SOURCES.txt

@@ -317,6 +317,7 @@ tests/test_public_interface.py
 tests/test_publish_workflow.py
 tests/test_quic_coalesced_datagram_ruling.py
 tests/test_quic_crypto_buffer_bound.py
+tests/test_quic_crypto_gap.py
 tests/test_quic_integration.py
 tests/test_quic_multipacket.py
 tests/test_quic_server_initial.py

{ja4plus-1.2.1 → ja4plus-1.2.2}/ja4plus.egg-info/requires.txt

@@ -4,17 +4,17 @@ cryptography>=42.0.0
 [dev]
 pytest==9.1.1
 pytest-cov==7.1.0
-ruff==0.16.2
+ruff==0.16.9
 mypy>=1.11
-build==1.5.0
+build==1.6.1
 twine==7.0.0
 
 [docs]
 mkdocs==1.6.1
 mkdocs-material==9.7.7
 mkdocstrings==1.0.6
-mkdocstrings-python==2.0.5
-griffe==2.1.0
+mkdocstrings-python==2.0.9
+griffe==2.3.0
 
 [lookup]
 requests>=2.20.0

{ja4plus-1.2.1 → ja4plus-1.2.2}/pyproject.toml

@@ -96,7 +96,7 @@ dev = [
     # file under `.github/workflows/` and every second dependency record this repository
     # could carry. The `dev` extra therefore stays the one place a tool reads the version
     # from.
-    "ruff==0.16.2",
+    "ruff==0.16.9",
     # **The version floats, and #446 chose that shape against the four exact pins beside
     # it.** A pinned type checker falls behind, and a frozen release hides a defect that a
     # later release reports. A floating formatter turns a green tree red, which is noisy
@@ -122,7 +122,7 @@ dev = [
     # `python -m tests.release_verification --dist dist` reads the wheel this release
     # builds, and #576 ran it by hand because no continuous-integration job runs it.
     # Verified against https://pypi.org/pypi/build/1.5.0/json, retrieved 2026-08-10.
-    "build==1.5.0",
+    "build==1.6.1",
     # `FR-release-9` states `twine check` on the built files, and
     # `tests/release_verification.py` runs it. The publish workflow installs this extra, so
     # the version lives here and no workflow states one of its own.
@@ -182,8 +182,8 @@ docs = [
     "mkdocs==1.6.1",
     "mkdocs-material==9.7.7",
     "mkdocstrings==1.0.6",
-    "mkdocstrings-python==2.0.5",
-    "griffe==2.1.0",
+    "mkdocstrings-python==2.0.9",
+    "griffe==2.3.0",
 ]
 
 [project.urls]

{ja4plus-1.2.1 → ja4plus-1.2.2}/tests/test_documentation_site.py

@@ -504,34 +504,45 @@ def _dependency_block(text: str, opener: str) -> list[str]:
     return dependency_entries(text, opener)
 
 
-# The entries of the `dev` extra, in file order. **Every one of them carries a comment
+def _distribution_names(entries: list[str]) -> list[str]:
+    """Return the distribution name of each entry, without its version specifier.
+
+    The cases below read which entries the reader returns, and no version. A literal
+    that named each version failed every dependabot pull request that moved a pin. #760
+    and the pull requests #764, #766 and #767 measured that failure.
+    """
+    return [re.split(r"[=<>!~ ]", entry, maxsplit=1)[0] for entry in entries]
+
+
+# The distribution names of the `dev` extra, in file order. **Every entry carries a comment
 # above it, and that is the shape no caller of this reader read before #452.** The runtime
 # block and the `docs` extra carry no comment inside their brackets. A reader that collects
 # a comment therefore stays correct against those two blocks, and it fails here.
 DEV_ENTRIES = [
-    "pytest==9.1.1",
-    "pytest-cov==7.1.0",
-    "ruff==0.16.2",
-    "mypy>=1.11",
-    "build==1.5.0",
-    "twine==7.0.0",
+    "pytest",
+    "pytest-cov",
+    "ruff",
+    "mypy",
+    "build",
+    "twine",
 ]
 
-# The entries of the runtime block, in file order. A user who installs `ja4plus` installs
-# these two distributions and no other.
+# The distribution names of the runtime block, in file order. A user who installs
+# `ja4plus` installs these two distributions and no other.
 RUNTIME_ENTRIES = [
-    "scapy>=2.4.0",
-    "cryptography>=42.0.0",
+    "scapy",
+    "cryptography",
 ]
 
-# The entries of the `docs` extra, in file order. #391 records the pair of versions that
-# the site build needs, so a case names every entry rather than the two it reads.
+# The distribution names of the `docs` extra, in file order. #391 records the pair of
+# versions that the site build needs, so a case names every entry rather than the two it
+# reads.
 DOCS_ENTRIES = [
-    "mkdocs==1.6.1",
-    "mkdocs-material==9.7.7",
-    "mkdocstrings==1.0.6",
-    "mkdocstrings-python==2.0.5",
-    "griffe==2.1.0",
+    "mkdocs",
+    "mkdocs-material",
+    "mkdocstrings",
+    "mkdocstrings-python",
+    "griffe",
 ]
 
 
@@ -544,7 +555,7 @@ def test_the_reader_returns_the_entries_of_the_dev_extra_and_no_comment_fragment
     defect.
     """
     entries = _dependency_block(PYPROJECT.read_text(encoding="utf-8"), "dev = [")
-    assert entries == DEV_ENTRIES
+    assert _distribution_names(entries) == DEV_ENTRIES
 
 
 def test_the_reader_returns_every_entry_of_the_runtime_block_by_name() -> None:
@@ -554,13 +565,13 @@ def test_the_reader_returns_every_entry_of_the_runtime_block_by_name() -> None:
     fragment. This case therefore names every entry the block holds.
     """
     entries = _dependency_block(PYPROJECT.read_text(encoding="utf-8"), "dependencies = [")
-    assert entries == RUNTIME_ENTRIES
+    assert _distribution_names(entries) == RUNTIME_ENTRIES
 
 
 def test_the_reader_returns_every_entry_of_the_docs_extra_by_name() -> None:
     """`_dependency_block` returns the documentation dependencies and drops none of them."""
     entries = _dependency_block(PYPROJECT.read_text(encoding="utf-8"), "docs = [")
-    assert entries == DOCS_ENTRIES
+    assert _distribution_names(entries) == DOCS_ENTRIES
 
 
 def test_the_documentation_dependency_stays_out_of_the_runtime_dependencies() -> None:

{ja4plus-1.2.1 → ja4plus-1.2.2}/tests/test_quic_crypto_buffer_bound.py

@@ -52,8 +52,15 @@ def test_the_reassembler_keeps_the_real_fragment_beside_a_hostile_one():
 
 
 def test_the_reassembler_allocates_no_more_than_the_limit():
-    """The buffer never passes `MAXIMUM_CRYPTO_BUFFER_BYTES`."""
-    fragments = [(MAXIMUM_CRYPTO_BUFFER_BYTES - 1, b"x")]
+    """The buffer never passes `MAXIMUM_CRYPTO_BUFFER_BYTES`.
+
+    The reader returns no byte past a gap, so the fragments cover every offset. #762
+    records that change.
+    """
+    fragments = [
+        (0, bytes(MAXIMUM_CRYPTO_BUFFER_BYTES - 1)),
+        (MAXIMUM_CRYPTO_BUFFER_BYTES - 1, b"x"),
+    ]
     assert len(reassemble_crypto_fragments(fragments)) == MAXIMUM_CRYPTO_BUFFER_BYTES
 
 

ja4plus-1.2.2/tests/test_quic_crypto_gap.py

@@ -0,0 +1,132 @@
+"""A gap in the QUIC CRYPTO stream stops the reassembler.
+
+#762 reports the defect. The reassembler allocated a buffer up to the highest fragment
+end and left each unreceived range as zero bytes. A ClientHello whose last fragment
+arrived before a middle fragment then passed the length check, and the TLS reader parsed
+the zero bytes as extensions. The reader produced a JA4 value that no reference holds.
+
+The cases below replay the fragment layout of #762 against the ClientHello of the FoxIO
+capture `quic-with-several-tls-frames.pcapng`. That ClientHello holds 295 bytes, so the
+layout keeps the shape of the report and scales the offsets.
+"""
+
+from pathlib import Path
+
+from scapy.all import IP, UDP, Raw, rdpcap
+
+from ja4plus.fingerprinters.ja4 import JA4Fingerprinter
+from ja4plus.utils import quic_utils
+from ja4plus.utils.quic_utils import (
+    client_hello_from_crypto_fragments,
+    decrypt_quic_initial_crypto,
+    reassemble_crypto_fragments,
+    server_hello_is_complete,
+)
+
+VECTORS_DIR = Path(__file__).parent / "foxio_vectors"
+CAPTURE_PATH = VECTORS_DIR / "quic-with-several-tls-frames.pcapng"
+EXPECTED_PATH = (
+    VECTORS_DIR / "rust_expected" / "ja4__insta@quic-with-several-tls-frames.pcapng.snap"
+)
+
+
+def _client_hello_bytes():
+    """Return the whole ClientHello that the one Initial packet of the capture carries."""
+    for packet in rdpcap(str(CAPTURE_PATH)):
+        if UDP not in packet:
+            continue
+        fragments, _ = decrypt_quic_initial_crypto(bytes(packet[UDP].payload))
+        if fragments:
+            return reassemble_crypto_fragments(fragments)
+    raise AssertionError(f"{CAPTURE_PATH} holds no QUIC client Initial packet")
+
+
+def _reference_ja4():
+    """Return the one JA4 value the FoxIO snapshot holds for the capture."""
+    values = [
+        line.strip()[len("ja4: ") :]
+        for line in EXPECTED_PATH.read_text().splitlines()
+        if line.strip().startswith("ja4: ")
+    ]
+    assert len(values) == 1, f"{EXPECTED_PATH} holds {len(values)} JA4 values"
+    return values[0]
+
+
+def _split(data, bounds):
+    """Return the (offset, bytes) pair of each half-open range in `bounds`."""
+    return [(start, data[start:end]) for start, end in bounds]
+
+
+def _issue_layout(client_hello):
+    """Return the fragments of the two datagrams, in the shape #762 reports.
+
+    The first datagram carries the head and the tail, and the second one carries the
+    middle. The first datagram alone therefore reaches the last byte and leaves a gap.
+    """
+    end = len(client_hello)
+    first = _split(client_hello, [(0, 36), (36, 70), (200, end)])
+    second = _split(client_hello, [(70, 115), (115, 200)])
+    return first, second
+
+
+def test_the_reassembler_stops_at_the_first_gap():
+    assert reassemble_crypto_fragments([(0, b"ab"), (5, b"xy")]) == b"ab"
+
+
+def test_the_reassembler_returns_nothing_when_no_fragment_starts_at_offset_zero():
+    assert reassemble_crypto_fragments([(3, b"xyz")]) == b""
+
+
+def test_the_reassembler_joins_overlapping_fragments():
+    assert reassemble_crypto_fragments([(0, b"hello"), (3, b"lo world")]) == b"hello world"
+
+
+def test_the_reassembler_keeps_a_fragment_that_a_longer_one_covers():
+    fragments = [(0, b"hello world"), (6, b"wor")]
+    assert reassemble_crypto_fragments(fragments) == b"hello world"
+
+
+def test_a_client_hello_with_a_gap_produces_no_parse():
+    client_hello = _client_hello_bytes()
+    first, _ = _issue_layout(client_hello)
+    assert client_hello_from_crypto_fragments(first) is None
+
+
+def test_the_client_hello_parses_once_the_gap_fills():
+    client_hello = _client_hello_bytes()
+    first, second = _issue_layout(client_hello)
+    whole = client_hello_from_crypto_fragments([(0, client_hello)])
+    assert whole is not None
+    assert client_hello_from_crypto_fragments(first + second) == whole
+
+
+def test_a_server_hello_with_a_gap_is_not_complete():
+    server_hello = bytes([0x02, 0x00, 0x00, 0x06]) + b"abcdef"
+    assert not server_hello_is_complete([(0, server_hello[:4]), (8, server_hello[8:])])
+    assert server_hello_is_complete([(0, server_hello[:4]), (4, server_hello[4:])])
+
+
+def _quic_packet():
+    """Return one UDP datagram whose payload starts a QUIC long header."""
+    return (
+        IP(src="1.1.1.1", dst="2.2.2.2")
+        / UDP(sport=50000, dport=443)
+        / Raw(load=b"\x80" + b"\x00" * 30)
+    )
+
+
+def test_the_fingerprinter_waits_for_the_gap_and_then_produces_the_reference_ja4(
+    monkeypatch,
+):
+    """The first datagram produces nothing, and the second one produces the FoxIO value.
+
+    The `monkeypatch` fixture restores the decryption function on teardown.
+    """
+    first, second = _issue_layout(_client_hello_bytes())
+    dcid = b"\xaa\xbb\xcc\xdd"
+    datagrams = iter([(first, dcid), (second, dcid)])
+    monkeypatch.setattr(quic_utils, "decrypt_quic_initial_crypto", lambda _: next(datagrams))
+
+    fingerprinter = JA4Fingerprinter()
+    assert fingerprinter.process_packet(_quic_packet()) is None
+    assert fingerprinter.process_packet(_quic_packet()) == _reference_ja4()