Location: isotp/transport.go:8-11 (package doc), isotp/transport.go:120-122 (Send), isotp/transport.go:235-273 (Recv)
Finding: Send unconditionally rejects payloads over 4095 bytes, and Recv only ever reads the First-Frame length from the classic 12-bit field. ISO 15765-2's length-escape mechanism — where a 12-bit length field of zero signals that the real length follows as a 32-bit value in the next four bytes, allowing far larger transfers — is not implemented, and neither is the CAN-FD single/first-frame length-escape encoding. Addressing is also limited to plain "normal addressing": Config has no address-extension byte, and ExtIDs only controls whether 29-bit CAN IDs are used, not an ISO-TP addressing mode. Despite this, the package doc claims payload support "of up to 4095 bytes (classic) or larger with extended addressing," which conflates CAN ID width with ISO-TP addressing mode and overstates what the package actually does — extended/mixed/normal-fixed addressing isn't implemented at all, and the "larger" claim has no corresponding code path.
Recommendation: Either implement the 32-bit FF_DL escape (and CAN-FD length encoding) plus real addressing-mode support, or narrow the doc comment to state plainly that only normal addressing and payloads up to 4095 bytes are supported today.
Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.
Location:
isotp/transport.go:8-11(package doc),isotp/transport.go:120-122(Send),isotp/transport.go:235-273(Recv)Finding:
Sendunconditionally rejects payloads over 4095 bytes, andRecvonly ever reads the First-Frame length from the classic 12-bit field. ISO 15765-2's length-escape mechanism — where a 12-bit length field of zero signals that the real length follows as a 32-bit value in the next four bytes, allowing far larger transfers — is not implemented, and neither is the CAN-FD single/first-frame length-escape encoding. Addressing is also limited to plain "normal addressing":Confighas no address-extension byte, andExtIDsonly controls whether 29-bit CAN IDs are used, not an ISO-TP addressing mode. Despite this, the package doc claims payload support "of up to 4095 bytes (classic) or larger with extended addressing," which conflates CAN ID width with ISO-TP addressing mode and overstates what the package actually does — extended/mixed/normal-fixed addressing isn't implemented at all, and the "larger" claim has no corresponding code path.Recommendation: Either implement the 32-bit FF_DL escape (and CAN-FD length encoding) plus real addressing-mode support, or narrow the doc comment to state plainly that only normal addressing and payloads up to 4095 bytes are supported today.
Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.