arch: minor cleanups to winpcapy and libpcap

[gpotter2]

Prompted by #5209

[codecov]

Codecov Report

❌ Patch coverage is 80.76923% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.17%. Comparing base (90623e7) to head (46a371c).

Files with missing lines	Patch %	Lines
scapy/arch/libpcap.py	75.00%	3 Missing ⚠️
scapy/config.py	81.81%	2 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #5211   +/-   ##
=======================================
  Coverage   81.16%   81.17%           
=======================================
  Files         393      393           
  Lines       98120    98134   +14     
=======================================
+ Hits        79637    79658   +21     
+ Misses      18483    18476    -7     

Files with missing lines	Coverage Δ
scapy/arch/windows/__init__.py	66.29% <100.00%> (+0.06%)	⬆️
scapy/config.py	85.44% <81.81%> (-0.19%)	⬇️
scapy/arch/libpcap.py	77.16% <75.00%> (+0.75%)	⬆️

... and 7 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gpotter2]

Sometimes I forget how some of our arch/ is very ugly. This PR side-tracked a lot.

[KernelClint]

Fine by me to go with this one. I tested it by reading a pcap file through libpcap:

Platform	master	#5211
NetBSD 10.1 i386	wrong lengths	pass
Alpine 3.22 i386 and armv7 (musl)	wrong lengths or segfault	segfault
Debian 13 armhf	wrong lengths	segfault
Debian 13 i386 and x86_64, macOS arm64	pass	pass

So it fixes NetBSD, but not 32-bit Linux where time_t is 64-bit: musl, and Debian 13 on armhf (which Raspberry Pi OS 32-bit is built on). There, both fields of struct timeval are 64-bit, so caplen is at byte 16 rather than 8. Your new test does catch it (it crashes there), but only when run on those platforms. I can send that extra branch if you want it.

Two smaller things:

• The new test's packet has the same captured length and length on the wire, so it still passes with the GHSA-c547 fix reverted. The test it replaces checked that. Could you keep it as well?
• _socket_changer has elif attr == "use_bsd":, which I think is meant to be "use_bpf".

[gpotter2]

Thanks a lot for the review.

The new test's packet has the same captured length and length on the wire, so it still passes with the GHSA-c547 fix reverted. The test it replaces checked that. Could you keep it as well?

You're right, see b0a6933.