pymodbus-dev__pymodbus-1923

The user is reporting an issue where `pymodbus` does not correctly handle reassembled TCP segments.
When a Modbus response is split over multiple TCP frames, `pymodbus` seems to try parsing the first (incomplete) frame as a full response, fails the frame check, discards it, and then tries to parse the subsequent (also incomplete) frames, leading to errors.

The logs provided show:
1. `recv: 0x0 0x1 0x0 0x0 0x0 0xb 0x1 0x3 0x8 0x0 0xb5 0x12 0x2f 0x37 0x21 0x0 old_data:  addr=None`
2. `Processing: 0x0 0x1 0x0 0x0 0x0 0xb 0x1 0x3 0x8 0x0 0xb5 0x12 0x2f 0x37 0x21 0x0`
3. `Frame check failed, ignoring!!`
4. `Resetting frame - Current Frame in buffer - 0x0 0x1 0x0 0x0 0x0 0xb 0x1 0x3 0x8 0x0 0xb5 0x12 0x2f 0x37 0x21 0x0`
5. `recv: 0x3 old_data:  addr=None`
6. `Processing: 0x3`
7. `Factory Response[ReadHoldingRegistersResponse': 3]`
8. `General exception: index out of range`
9. `pymodbus.exceptions.ModbusIOException: Modbus Error: [Input/Output] Unable to decode request`

Wait, looking at the logs more closely:
The first packet received was `0x0 0x1 0x0 0x0 0x0 0xb 0x1 0x3 0x8 0x0 0xb5 0x12 0x2f 0x37 0x21 0x0`.
The second packet was `0x3`.
The total response is `0x0 0x1 0x0 0x0 0x0 0xb 0x1 0x3 0x8 0x0 0xb5 0x12 0x2f 0x37 0x21 0x0 0x3`.

It seems `pymodbus` is trying to process the frame as soon as `data_received` is called, instead of buffering until a full Modbus TCP frame is received according to the length specified in the MBAP header.

The MBAP header for Modbus TCP is:
- Transaction Identifier (2 bytes)
- Protocol Identifier (2 bytes)
- Length (2 bytes)
- Unit Identifier (1 byte)

In the example: `0x0 0x1` (TransId), `0x0 0x0` (ProtId), `0x0 0xb` (Length = 11), `0x1` (UnitId).
Length 11 means there are 11 bytes following the length field.
UnitId (1 byte) + PDU (10 bytes).
The first packet had: `0x0 0x1 0x0 0x0 0x0 0xb 0x1 0x3 0x8 0x0 0xb5 0x12 0x2f 0x37 0x21 0x0`.
Bytes after length (`0x0 0xb`): `0x1 0x3 0x8 0x0 0xb5 0x12 0x2f 0x37 0x21 0x0` (10 bytes).
But the length was 11. So it's missing 1 byte.
The next packet has that 1 byte: `0x3`.

The code in `pymodbus/framer/socket_framer.py` likely handles the processing of incoming TCP packets.
The traceback points to:
`pymodbus/transport/transport.py`, line 318, in `data_received`
`pymodbus/transport/transport.py`, line 352, in `datagram_received`
`pymodbus/client/base.py`, line 186, in `callback_data`
`pymodbus/framer/base.py`, line 139, in `processIncomingPacket`
`pymodbus/framer/socket_framer.py`, line 136, in `frameProcessIncomingPacket`
`pymodbus/framer/socket_framer.py`, line 154, in `_process`

I need to examine `pymodbus/framer/socket_framer.py` and see how it handles buffering.

Let's start by exploring the code.

{
  "command": "grep -rn --include=\"*.py\" -E \"processIncomingPacket|frameProcessIncomingPacket\" pymodbus/framer/"
}

{
  "status": "ok",
  "stdout": "pymodbus/framer/binary_framer.py:121:    def frameProcessIncomingPacket(self, single, callback, slave, _tid=None, **kwargs):\npymodbus/framer/base.py:115:    def processIncomingPacket(self, data, callback, slave, **kwargs):\npymodbus/framer/base.py:139:        self.frameProcessIncomingPacket(single, callback, slave, **kwargs)\npymodbus/framer/base.py:141:    def frameProcessIncomingPacket(\npymodbus/framer/socket_framer.py:119:    def frameProcessIncomingPacket(self, single, callback, slave, tid=None, **kwargs):\npymodbus/framer/tls_framer.py:91:    def frameProcessIncomingPacket(self, single, callback, slave, _tid=None, **kwargs):\npymodbus/framer/ascii_framer.py:111:    def frameProcessIncomingPacket(self, single, callback, slave, _tid=None, **kwargs):\npymodbus/framer/rtu_framer.py:208:    def frameProcessIncomingPacket(self, single, callback, slave, _tid=None, **kwargs):\n",
  "stderr": "",
  "exit_code": 0
}

Okay, I see `pymodbus/framer/socket_framer.py` is where `frameProcessIncomingPacket` is implemented for TCP. Let's examine it.

{
  "filepath": "pymodbus/framer/socket_framer.py"
}

{
  "status": "ok",
  "filepath": "pymodbus/framer/socket_framer.py",
  "content": "\"\"\"Socket framer.\"\"\"\n# pylint: disable=missing-type-doc\nimport struct\n\nfrom pymodbus.exceptions import (\n    InvalidMessageReceivedException,\n    ModbusIOException,\n)\nfrom pymodbus.framer.base import SOCKET_FRAME_HEADER, ModbusFramer\nfrom pymodbus.logging import Log\n\n\n# --------------------------------------------------------------------------- #\n# Modbus TCP Message\n# --------------------------------------------------------------------------- #\n\n\nclass ModbusSocketFramer(ModbusFramer):\n    \"\"\"Modbus Socket Frame controller.\n\n    Before each modbus TCP message is an MBAP header which is used as a\n    message frame.  It allows us to easily separate messages as follows::\n\n        [         MBAP Header         ] [ Function Code] [ Data ] \\\n        [ tid ][ pid ][ length ][ uid ]\n          2b     2b     2b        1b           1b           Nb\n\n        while len(message) > 0:\n            tid, pid, length`, uid = struct.unpack(\">HHHB\", message)\n            request = message[0:7 + length - 1`]\n            message = [7 + length - 1:]\n\n        * length = uid + function code + data\n        * The -1 is to account for the uid byte\n    \"\"\"\n\n    method = \"socket\"\n\n    def __init__(self, decoder, client=None):\n        \"\"\"Initialize a new instance of the framer.\n\n        :param decoder: The decoder factory implementation to use\n        \"\"\"\n        super().__init__(decoder, client)\n        self._hsize = 0x07\n\n    # ----------------------------------------------------------------------- #\n    # Private Helper Functions\n    # ----------------------------------------------------------------------- #\n    def checkFrame(self):\n        \"\"\"Check and decode the next frame.\n\n        Return true if we were successful.\n        \"\"\"\n        if self.isFrameReady():\n            (\n                self._header[\"tid\"],\n                self._header[\"pid\"],\n                self._header[\"len\"],\n                self._header[\"uid\"],\n            ) = struct.unpack(\">HHHB\", self._buffer[0 : self._hsize])\n\n            # someone sent us an error? ignore it\n            if self._header[\"len\"] < 2:\n                self.advanceFrame()\n            # we have at least a complete message, continue\n            elif len(self._buffer) - self._hsize + 1 >= self._header[\"len\"]:\n                return True\n        # we don't have enough of a message yet, wait\n        return False\n\n    def advanceFrame(self):\n        \"\"\"Skip over the current framed message.\n\n        This allows us to skip over the current message after we have processed\n        it or determined that it contains an error. It also has to reset the\n        current frame header handle\n        \"\"\"\n        length = self._hsize + self._header[\"len\"] - 1\n        self._buffer = self._buffer[length:]\n        self._header = {\"tid\": 0, \"pid\": 0, \"len\": 0, \"uid\": 0}\n\n    def isFrameReady(self):\n        \"\"\"Check if we should continue decode logic.\n\n        This is meant to be used in a while loop in the decoding phase to let\n        the decoder factory know that there is still data in the buffer.\n\n        :returns: True if ready, False otherwise\n        \"\"\"\n        return len(self._buffer) > self._hsize\n\n    def getFrame(self):\n        \"\"\"Return the next frame from the buffered data.\n\n        :returns: The next full frame buffer\n        \"\"\"\n        length = self._hsize + self._header[\"len\"] - 1\n        return self._buffer[self._hsize : length]\n\n    # ----------------------------------------------------------------------- #\n    # Public Member Functions\n    # ----------------------------------------------------------------------- #\n    def decode_data(self, data):\n        \"\"\"Decode data.\"\"\"\n        if len(data) > self._hsize:\n            tid, pid, length, uid, fcode = struct.unpack(\n                SOCKET_FRAME_HEADER, data[0 : self._hsize + 1]\n            )\n            return {\n                \"tid\": tid,\n                \"pid\": pid,\n                \"length\": length,\n                \"slave\": uid,\n                \"fcode\": fcode,\n            }\n        return {}\n\n    def frameProcessIncomingPacket(self, single, callback, slave, tid=None, **kwargs):\n        \"\"\"Process new packet pattern.\n\n        This takes in a new request packet, adds it to the current\n        packet stream, and performs framing on it. That is, checks\n        for complete messages, and once found, will process all that\n        exist.  This handles the case when we read N + 1 or 1 // N\n        messages at a time instead of 1.\n\n        The processed and decoded messages are pushed to the callback\n        function to process and send.\n        \"\"\"\n        while True:\n            if not self.isFrameReady():\n                if len(self._buffer):\n                    # Possible error ???\n                    if self._header[\"len\"] < 2:\n                        self._process(callback, tid, error=True)\n                break\n            if not self.checkFrame():\n                Log.debug(\"Frame check failed, ignoring!!\")\n                self.resetFrame()\n                continue\n            if not self._validate_slave_id(slave, single):\n                header_txt = self._header[\"uid\"]\n                Log.debug(\"Not a valid slave id - {}, ignoring!!\", header_txt)\n                self.resetFrame()\n                continue\n            self._process(callback, tid)\n\n    def _process(self, callback, tid, error=False):\n        \"\"\"Process incoming packets irrespective error condition.\"\"\"",
  "start_line": 1,
  "end_line": 150,
  "total_lines": 182,
  "is_truncated": true
}

I need to see the rest of `pymodbus/framer/socket_framer.py`, specifically the `_process` and `resetFrame` methods.

{
  "filepath": "pymodbus/framer/socket_framer.py",
  "start_line": 151
}

{
  "status": "ok",
  "filepath": "pymodbus/framer/socket_framer.py",
  "content": "        data = self._buffer if error else self.getFrame()\n        if (result := self.decoder.decode(data)) is None:\n            self.resetFrame()\n            raise ModbusIOException(\"Unable to decode request\")\n        if error and result.function_code < 0x80:\n            raise InvalidMessageReceivedException(result)\n        self.populateResult(result)\n        self.advanceFrame()\n        if tid and tid != result.transaction_id:\n            self.resetFrame()\n        else:\n            callback(result)  # defer or push to a thread?\n\n    def buildPacket(self, message):\n        \"\"\"Create a ready to send modbus packet.\n\n        :param message: The populated request/response to send\n        \"\"\"\n        data = message.encode()\n        packet = struct.pack(\n            SOCKET_FRAME_HEADER,\n            message.transaction_id,\n            message.protocol_id,\n            len(data) + 2,\n            message.slave_id,\n            message.function_code,\n        )\n        packet += data\n        return packet\n\n\n# __END__",
  "start_line": 151,
  "end_line": 182,
  "total_lines": 182,
  "is_truncated": false
}

Wait, I don't see `resetFrame` in `pymodbus/framer/socket_framer.py`. It must be in the base class `ModbusFramer`.

Let's look at `pymodbus/framer/base.py`.

{
  "filepath": "pymodbus/framer/base.py"
}

{
  "status": "ok",
  "filepath": "pymodbus/framer/base.py",
  "content": "\"\"\"Framer start.\"\"\"\n# pylint: disable=missing-type-doc\nfrom __future__ import annotations\n\nfrom typing import Any\n\nfrom pymodbus.factory import ClientDecoder, ServerDecoder\nfrom pymodbus.logging import Log\n\n\n# Unit ID, Function Code\nBYTE_ORDER = \">\"\nFRAME_HEADER = \"BB\"\n\n# Transaction Id, Protocol ID, Length, Unit ID, Function Code\nSOCKET_FRAME_HEADER = BYTE_ORDER + \"HHH\" + FRAME_HEADER\n\n# Function Code\nTLS_FRAME_HEADER = BYTE_ORDER + \"B\"\n\n\nclass ModbusFramer:\n    \"\"\"Base Framer class.\"\"\"\n\n    name = \"\"\n\n    def __init__(\n        self,\n        decoder: ClientDecoder | ServerDecoder,\n        client=None,\n    ) -> None:\n        \"\"\"Initialize a new instance of the framer.\n\n        :param decoder: The decoder implementation to use\n        \"\"\"\n        self.decoder = decoder\n        self.client = client\n        self._header: dict[str, Any] = {\n            \"lrc\": \"0000\",\n            \"len\": 0,\n            \"uid\": 0x00,\n            \"tid\": 0,\n            \"pid\": 0,\n            \"crc\": b\"\\x00\\x00\",\n        }\n        self._buffer = b\"\"\n\n    def _validate_slave_id(self, slaves: list, single: bool) -> bool:\n        \"\"\"Validate if the received data is valid for the client.\n\n        :param slaves: list of slave id for which the transaction is valid\n        :param single: Set to true to treat this as a single context\n        :return:\n        \"\"\"\n        if single:\n            return True\n        if 0 in slaves or 0xFF in slaves:\n            # Handle Modbus TCP slave identifier (0x00 0r 0xFF)\n            # in asynchronous requests\n            return True\n        return self._header[\"uid\"] in slaves\n\n    def sendPacket(self, message):\n        \"\"\"Send packets on the bus.\n\n        With 3.5char delay between frames\n        :param message: Message to be sent over the bus\n        :return:\n        \"\"\"\n        return self.client.send(message)\n\n    def recvPacket(self, size):\n        \"\"\"Receive packet from the bus.\n\n        With specified len\n        :param size: Number of bytes to read\n        :return:\n        \"\"\"\n        return self.client.recv(size)\n\n    def resetFrame(self):\n        \"\"\"Reset the entire message frame.\n\n        This allows us to skip ovver errors that may be in the stream.\n        It is hard to know if we are simply out of sync or if there is\n        an error in the stream as we have no way to check the start or\n        end of the message (python just doesn't have the resolution to\n        check for millisecond delays).\n        \"\"\"\n        Log.debug(\n            \"Resetting frame - Current Frame in buffer - {}\", self._buffer, \":hex\"\n        )\n        self._buffer = b\"\"\n        self._header = {\n            \"lrc\": \"0000\",\n            \"crc\": b\"\\x00\\x00\",\n            \"len\": 0,\n            \"uid\": 0x00,\n            \"pid\": 0,\n            \"tid\": 0,\n        }\n\n    def populateResult(self, result):\n        \"\"\"Populate the modbus result header.\n\n        The serial packets do not have any header information\n        that is copied.\n\n        :param result: The response packet\n        \"\"\"\n        result.slave_id = self._header.get(\"uid\", 0)\n        result.transaction_id = self._header.get(\"tid\", 0)\n        result.protocol_id = self._header.get(\"pid\", 0)\n\n    def processIncomingPacket(self, data, callback, slave, **kwargs):\n        \"\"\"Process new packet pattern.\n\n        This takes in a new request packet, adds it to the current\n        packet stream, and performs framing on it. That is, checks\n        for complete messages, and once found, will process all that\n        exist.  This handles the case when we read N + 1 or 1 // N\n        messages at a time instead of 1.\n\n        The processed and decoded messages are pushed to the callback\n        function to process and send.\n\n        :param data: The new packet data\n        :param callback: The function to send results to\n        :param slave: Process if slave id matches, ignore otherwise (could be a\n               list of slave ids (server) or single slave id(client/server))\n        :param kwargs:\n        :raises ModbusIOException:\n        \"\"\"\n        Log.debug(\"Processing: {}\", data, \":hex\")\n        self._buffer += data\n        if not isinstance(slave, (list, tuple)):\n            slave = [slave]\n        single = kwargs.pop(\"single\", False)\n        self.frameProcessIncomingPacket(single, callback, slave, **kwargs)\n\n    def frameProcessIncomingPacket(\n        self, _single, _callback, _slave, _tid=None, **kwargs\n    ):\n        \"\"\"Process new packet pattern.\"\"\"",
  "start_line": 1,
  "end_line": 144,
  "total_lines": 144,
  "is_truncated": false
}

Now let's look at `ModbusSocketFramer.frameProcessIncomingPacket` again.

```python
    def frameProcessIncomingPacket(self, single, callback, slave, tid=None, **kwargs):
        """Process new packet pattern.

        This takes in a new request packet, adds it to the current
        packet stream, and performs framing on it. That is, checks
        for complete messages, and once found, will process all that
        exist.  This handles the case when we read N + 1 or 1 // N
        messages at a time instead of 1.

        The processed and decoded messages are pushed to the callback
        function to process and send.
        """
        while True:
            if not self.isFrameReady():
                if len(self._buffer):
                    # Possible error ???
                    if self._header["len"] < 2:
                        self._process(callback, tid, error=True)
                break
            if not self.checkFrame():
                Log.debug("Frame check failed, ignoring!!")
                self.resetFrame()
                continue
            if not self._validate_slave_id(slave, single):
                header_txt = self._header["uid"]
                Log.debug("Not a valid slave id - {}, ignoring!!", header_txt)
                self.resetFrame()
                continue
            self._process(callback, tid)
```

And `checkFrame`:

```python
    def checkFrame(self):
        """Check and decode the next frame.

        Return true if we were successful.
        """
        if self.isFrameReady():
            (
                self._header["tid"],
                self._header["pid"],
                self._header["len"],
                self._header["uid"],
            ) = struct.unpack(">HHHB", self._buffer[0 : self._hsize])

            # someone sent us an error? ignore it
            if self._header["len"] < 2:
                self.advanceFrame()
            # we have at least a complete message, continue
            elif len(self._buffer) - self._hsize + 1 >= self._header["len"]:
                return True
        # we don't have enough of a message yet, wait
        return False
```

Wait, if `isFrameReady()` is true (length > 7), but `checkFrame()` returns `False` because the full frame hasn't arrived yet (`len(self._buffer) - self._hsize + 1 < self._header["len"]`), then `frameProcessIncomingPacket` does this:

```python
            if not self.checkFrame():
                Log.debug("Frame check failed, ignoring!!")
                self.resetFrame()
                continue
```

`self.resetFrame()` clears the entire buffer! `self._buffer = b""`.
This is exactly what the issue description says. If a frame is split, the first part triggers `isFrameReady()` but fails `checkFrame()`, and then the buffer is reset, losing the first part of the frame.

The fix should be to just `break` the loop and wait for more data instead of calling `resetFrame()` when `checkFrame()` returns `False` due to insufficient data.

Wait, let's re-read `checkFrame`.

```python
    def checkFrame(self):
        if self.isFrameReady():
            (
                self._header["tid"],
                self._header["pid"],
                self._header["len"],
                self._header["uid"],
            ) = struct.unpack(">HHHB", self._buffer[0 : self._hsize])

            if self._header["len"] < 2:
                self.advanceFrame()
                # Note: advanceFrame() does self._buffer = self._buffer[length:]
                # But it doesn't return anything.
                # Wait, checkFrame returns None here, which is Falsey.
            elif len(self._buffer) - self._hsize + 1 >= self._header["len"]:
                return True
        return False
```

If `self._header["len"] < 2`, it calls `advanceFrame()` and then returns `None` (False).
In `frameProcessIncomingPacket`:
```python
            if not self.checkFrame():
                Log.debug("Frame check failed, ignoring!!")
                self.resetFrame()
                continue
```
If `checkFrame` returned `False` because `len(self._buffer)` was not enough, we should just `break` the loop and wait for more data. We should ONLY `resetFrame()` or `advanceFrame()` if the frame is actually invalid (e.g. `len < 2`).

But `checkFrame` combined `len < 2` and `incomplete frame` into returning `False`.

Let's see how to distinguish between "not enough data" and "invalid frame".

If `isFrameReady()` is false, it breaks:
```python
            if not self.isFrameReady():
                if len(self._buffer):
                    # Possible error ???
                    if self._header["len"] < 2:
                        self._process(callback, tid, error=True)
                break
```

If `isFrameReady()` is true, but `checkFrame()` is false, it resets.

The logic in `checkFrame` is:
1. If `len(self._buffer) <= 7`, return `False` (implicitly because `isFrameReady` is false).
2. If `len(self._buffer) > 7`:
    a. Unpack header.
    b. If `length < 2` (invalid), call `advanceFrame()` and return `False` (None).
    c. If `len(self._buffer) - 7 + 1 >= length` (enough data), return `True`.
    d. Otherwise (not enough data), return `False`.

So `checkFrame` returns `False` for both invalid lengths and incomplete frames.

If we want to distinguish them, we could have `checkFrame` return different values or handle them differently.

Actually, if `self._header["len"] < 2`, it's an invalid frame and we should advance.
If `len(self._buffer) - 7 + 1 < length`, it's an incomplete frame and we should wait.

Let's refine `checkFrame` and `frameProcessIncomingPacket`.

Currently:
```python
    def checkFrame(self):
        if self.isFrameReady():
            (
                self._header["tid"],
                self._header["pid"],
                self._header["len"],
                self._header["uid"],
            ) = struct.unpack(">HHHB", self._buffer[0 : self._hsize])

            # someone sent us an error? ignore it
            if self._header["len"] < 2:
                self.advanceFrame()
            # we have at least a complete message, continue
            elif len(self._buffer) - self._hsize + 1 >= self._header["len"]:
                return True
        # we don't have enough of a message yet, wait
        return False
```

If I change `checkFrame` to return a signal:
- `True`: Frame is ready.
- `False`: Frame is not ready yet, wait for more data.
- `None` or `Exception`: Frame is invalid.

Or better:
Keep `checkFrame` as is, but only call `resetFrame()` when it's actually an error.

Wait, if `checkFrame` returns `False`, how do we know if it's because of `len < 2` or because not enough data?

If `self._header["len"] < 2` was true, `advanceFrame()` was called. `advanceFrame` modifies `self._buffer`.

Let's look at `advanceFrame`:
```python
    def advanceFrame(self):
        length = self._hsize + self._header["len"] - 1
        self._buffer = self._buffer[length:]
        self._header = {"tid": 0, "pid": 0, "len": 0, "uid": 0}
```

If `self._header["len"]` was, say, 1. Then `length = 7 + 1 - 1 = 7`. `self._buffer` is advanced by 7 bytes.

If `checkFrame` returns `False` because of `len < 2`, we have already advanced the frame. Calling `resetFrame()` then would clear the remaining buffer, which might contain the start of the NEXT frame.

The logic in `frameProcessIncomingPacket` is:
```python
            if not self.checkFrame():
                Log.debug("Frame check failed, ignoring!!")
                self.resetFrame()
                continue
```

This is definitely wrong for incomplete frames.

If `checkFrame` returned `False` because it's just not ready yet, we should just `break`.

How can we distinguish?
We can change `checkFrame` to return:
- `True` if frame is ready.
- `False` if frame is not ready (wait for more data).
- Raise an exception if frame is invalid (e.g. `len < 2`).

Or, return `True` for ready, `False` for not ready, and `None` for invalid.

Let's see:
```python
    def checkFrame(self):
        if not self.isFrameReady():
            return False # Not enough data for header
        
        (
            self._header["tid"],
            self._header["pid"],
            self._header["len"],
            self._header["uid"],
        ) = struct.unpack(">HHHB", self._buffer[0 : self._hsize])

        if self._header["len"] < 2:
            self.advanceFrame()
            return None # Invalid frame, but advanced
            
        if len(self._buffer) - self._hsize + 1 >= self._header["len"]:
            return True # Frame ready
            
        return False # Not enough data for full frame
```

Then in `frameProcessIncomingPacket`:
```python
            ready = self.checkFrame()
            if ready is True:
                # continue to validate slave and process
                pass
            elif ready is False:
                break # wait for more data
            else: # ready is None
                Log.debug("Frame check failed, ignoring!!")
                # We already advanced the frame in checkFrame, so maybe don't resetFrame?
                # Or if we want to be safe:
                self.resetFrame() 
                continue
```

Wait, the original code called `resetFrame()` which clears everything. If it's just incomplete, we MUST NOT call `resetFrame()`.

Let's check the logs again.
`recv: 0x0 0x1 0x0 0x0 0x0 0xb 0x1 0x3 0x8 0x0 0xb5 0x12 0x2f 0x37 0x21 0x0`
This has 16 bytes.
`self._hsize` is 7.
`isFrameReady()` returns `16 > 7` (True).
`struct.unpack(">HHHB", self._buffer[0:7])` gives `tid=0, pid=1, len=0x0, uid=0x0`?
Wait. `0x0 0x1 0x0 0x0 0x0 0xb 0x1`.
TID = `0x0 0x1` = 1
PID = `0x0 0x0` = 0
LEN = `0x0 0xb` = 11
UID = `0x1` = 1

So `self._header["len"]` is 11.
`len(self._buffer) - self._hsize + 1` = `16 - 7 + 1` = 10.
`10 >= 11` is `False`.
So `checkFrame` returns `False`.
And `frameProcessIncomingPacket` calls `resetFrame()`. Buffer gone.
Next packet `0x3` arrives. `len(self._buffer)` is 1.
`isFrameReady()` returns `1 > 7` (False).
The loop breaks.
Wait, if `isFrameReady()` is False, it does this:
```python
            if not self.isFrameReady():
                if len(self._buffer):
                    # Possible error ???
                    if self._header["len"] < 2:
                        self._process(callback, tid, error=True)
                break
```
Since `self._header["len"]` was reset to 0 (by `resetFrame`), `0 < 2` is True. `_process(callback, tid, error=True)` is called.
`_process(..., error=True)` uses `self._buffer` as data.
`self._buffer` contains `0x3`.
`decoder.decode(b'\x03')` is called. This probably fails with `index out of range` (as seen in the logs).

So the root cause is definitely `resetFrame()` being called when the frame is just incomplete.

Wait, the logs say:
`2024-01-04 11:16:16,635 DEBUG logging:103 Frame check failed, ignoring!!`
`2024-01-04 11:16:16,635 DEBUG logging:103 Resetting frame - Current Frame in buffer - 0x0 0x1 0x0 0x0 0x0 0xb 0x1 0x3 0x8 0x0 0xb5 0x12 0x2f 0x37 0x21 0x0`

This confirms `resetFrame()` was called.

I should modify `checkFrame` to distinguish between "incomplete" and "invalid".

Wait, let's look at how `ModbusFramer` (the base class) handles `processIncomingPacket`.
It just adds data to the buffer and calls `frameProcessIncomingPacket`.

If I change `checkFrame` to return something that indicates "need more data", then `frameProcessIncomingPacket` won't call `resetFrame()`.

Let's see if there is a better way.

If I change `checkFrame` to:
- Return `True` if frame is complete.
- Return `False` if frame is incomplete.
- Raise `InvalidMessageReceivedException` or similar if frame is invalid.

But `checkFrame` is called in a loop.

Let's try this:
In `checkFrame`:
- If `len < 2`, it's an invalid frame. We should advance and return something that tells the caller "something went wrong, but try again with what's left".
- If `buffer too short` for the given `len`, it's an incomplete frame. We should return something that tells the caller "stop and wait for more data".
- If `buffer long enough`, return `True` (complete).

Wait, `checkFrame` already returns `False` for both "incomplete" and "invalid" (after calling `advanceFrame`).

Actually, if `self._header["len"] < 2`, it is an invalid frame.
If `len(self._buffer) - self._hsize + 1 < self._header["len"]`, it is an incomplete frame.

I will change `checkFrame` to return:
- `True` if ready.
- `False` if incomplete.
- `None` if invalid.

And `frameProcessIncomingPacket` will:
- `True` -> proceed.
- `False` -> break loop.
- `None` -> `resetFrame` (or just `continue` if we already advanced).

Wait, if `checkFrame` returns `None` (invalid), it has already called `advanceFrame()`. Calling `resetFrame()` again would clear the remaining buffer, which might be the start of a valid frame. So `advanceFrame()` is enough.

Actually, the original code did:
```python
            if not self.checkFrame():
                Log.debug("Frame check failed, ignoring!!")
                self.resetFrame()
                continue
```
This is where the bug is. It treats `False` (incomplete) as a failure and resets everything.

Let's try to reproduce it first.
I need a Modbus server that sends the response in two parts.
Since I don't have a real server, I can mock one or use a script that stimulates the framer.

I can write a small script to test `ModbusSocketFramer` in isolation.

{
  "1, 0, 0, 0, 11, 1, 3, 8, 0, 0xb5, 0x12, 0x2f, 0x37, 0x21, 0])\n    packet2 = bytes([3])\n    \n    # We need to mock the processIncomingPacket calls\n    # In real life, this would be called by ModbusFramer.processIncomingPacket\n    # which calls framer.frameProcessIncomingPacket\n    \n    # Frame 1\n    framer._buffer += packet1\n    framer.frameProcessIncomingPacket(single=False, callback=cb, slave=[1])\n    print(f\"After packet 1": "buffer={framer._buffer.hex()",
  "PID=0, LEN=11, UID=1. PDU": "10 bytes. Total = 7 + 10 = 17 bytes.\n    # Packet 1: first 16 bytes.\n    # Packet 2: last 1 byte.\n    \n    packet1 = bytes([0",
  "]\n    def cb(result)": "callback.append(result)\n\n    # MBAP: TID=1",
  "data)": "self.data = data\n                self.transaction_id = 1\n                self.function_code = 3\n                self.slave_id = 1\n        return Result(data)\n\ndecoder = MockDecoder()\nframer = ModbusSocketFramer(decoder)\n\ndef test_fragmented_frame():\n    callback = [",
  "filepath": "/tmp/repro_framer.py**,content:",
  "from pymodbus.framer.socket_framer import ModbusSocketFramer\nfrom pymodbus.factory import ClientDecoder\n\nclass MockDecoder": "def decode(self",
  "}, callback_len={len(callback)}\")\n\nif __name__ == \"__main__\"": "test_fragmented_frame()\n<|\"|>",
  "}, callback_len={len(callback)}\")\n    \n    # Frame 2\n    framer._buffer += packet2\n    framer.frameProcessIncomingPacket(single=False, callback=cb, slave=[1])\n    print(f\"After packet 2": "buffer={framer._buffer.hex()"
}

{
  "error": "Invoking `write_file()` failed as the following mandatory input parameters are not present:\ncontent\nYou could retry calling this tool, but it is IMPORTANT for you to provide all the mandatory parameters."
}

I messed up the `write_file` call. Let me rewrite it properly. I will create a reproduction script that tests the `ModbusSocketFramer` directly.

{
  "content": "\nfrom pymodbus.framer.socket_framer import ModbusSocketFramer\n\nclass MockDecoder:\n    def decode(self, data):\n        # Just return a mock result object\n        class Result:\n            def __init__(self, data):\n                self.data = data\n                self.transaction_id = 1\n                self.function_code = 3\n                self.slave_id = 1\n        return Result(data)\n\ndef test_fragmented_frame():\n    decoder = MockDecoder()\n    framer = ModbusSocketFramer(decoder)\n    callback = []\n    def cb(result):\n        callback.append(result)\n\n    # MBAP: TID=1, PID=0, LEN=11, UID=1.\n    # Full frame: [0, 1, 0, 0, 0, 11, 1, 3, 8, 0, 0xb5, 0x12, 0x2f, 0x37, 0x21, 0, 3] (17 bytes)\n    full_frame = bytes([0, 1, 0, 0, 0, 11, 1, 3, 8, 0, 0xb5, 0x12, 0x2f, 0x37, 0x21, 0, 3])\n    packet1 = full_frame[:16]\n    packet2 = full_frame[16:]\n\n    print(f\"Packet 1: {packet1.hex()}\")\n    framer._buffer += packet1\n    framer.frameProcessIncomingPacket(single=False, callback=cb, slave=[1])\n    print(f\"After packet 1: buffer={framer._buffer.hex()}, callback_len={len(callback)}\")\n\n    print(f\"Packet 2: {packet2.hex()}\")\n    framer._buffer += packet2\n    framer.frameProcessIncomingPacket(single=False, callback=cb, slave=[1])\n    print(f\"After packet 2: buffer={framer._buffer.hex()}, callback_len={len(callback)}\")\n\n    if len(callback) == 1:\n        print(\"SUCCESS: Frame was reassembled and processed.\")\n    else:\n        print(f\"FAILURE: Frame was not processed correctly. Callback len: {len(callback)}\")\n\nif __name__ == \"__main__\":\n    test_fragmented_frame()\n",
  "filepath": "/tmp/repro_framer.py"
}

{
  "status": "error",
  "error_type": "FileWriteError",
  "error_message": "Path traversal detected: '/tmp/repro_framer.py' escapes workspace root."
}