From 4bc5e3fe6212e824518d655f30c7e504292448f2 Mon Sep 17 00:00:00 2001
From: Clinton Thomas <1033162+KernelClint@users.noreply.github.com>
Date: Tue, 1 Sep 2026 14:16:34 -0400
Subject: [PATCH] inet: choose the payload class from reassembled fragments

AI-Assisted: yes (GPT-5.6-Cyber)
---
 scapy/layers/inet.py       |  4 ++--
 test/scapy/layers/inet.uts | 22 ++++++++++++++++++++++
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/scapy/layers/inet.py b/scapy/layers/inet.py
index 006875bd53e..b6cb2bc1d61 100644
--- a/scapy/layers/inet.py
+++ b/scapy/layers/inet.py
@@ -1493,13 +1493,13 @@ def _defrag_ip_pkt(pkt, frags):
                 raise BadFragments(frags=badfrags)
             # re-build initial packet without fragmentation
             p = curfrags[0][0].copy()
-            pay_class = p[IP].payload.__class__
+            pay_class = p[IP].guess_payload_class(data)
             p[IP].flags.MF = False
             p[IP].remove_payload()
             p[IP].len = None
             p[IP].chksum = None
             # append defragmented payload
-            p /= pay_class(data)
+            p[IP].add_payload(pay_class(data))
             # cleanup
             del frags[uid]
             return True, p
diff --git a/test/scapy/layers/inet.uts b/test/scapy/layers/inet.uts
index 7803eb734f0..711d3558894 100644
--- a/test/scapy/layers/inet.uts
+++ b/test/scapy/layers/inet.uts
@@ -604,6 +604,28 @@ with no_debug_dissector(reverse=True):
 
 split_layers(TCP, CustomPacket, sport=12345)
 
+= TCPSession parses application data after IPv4 defragmentation
+~ http
+
+load_layer("http")
+
+def fragmented_http_response(fragsize):
+    payload = b"HTTP/1.1 200 OK\r\nContent-Length: 4\r\n\r\nBODY"
+    packet = (
+        IP(src="192.0.2.1", dst="192.0.2.2", id=1234) /
+        TCP(sport=80, dport=2345, seq=1, flags="PA") /
+        Raw(payload)
+    )
+    fragments = [IP(raw(pkt)) for pkt in fragment(packet, fragsize)]
+    return sniff(offline=fragments, session=TCPSession)
+
+with no_debug_dissector():
+    for fragsize in (8, 24):
+        packets = fragmented_http_response(fragsize)
+        assert len(packets) == 1
+        assert HTTPResponse in packets[0]
+        assert packets[0][Raw].load == b"BODY"
+
 
 = Layer binding