From 6a1fb680a5af64f2ec441f86c463efa2bf27a4a9 Mon Sep 17 00:00:00 2001
From: Barneey96 <barnabas.ajtay@proton.me>
Date: Thu, 10 Sep 2026 14:18:13 +0200
Subject: [PATCH 1/7] fix: resynchronize the client receive buffer

---
 src/client-response-handler.ts           | 40 +++++++++++-
 src/constants/limits.ts                  | 15 +++++
 src/modbus-rtu-client.ts                 | 11 +++-
 src/modbus-tcp-client.ts                 | 12 +++-
 src/rtu-client-response-handler.ts       | 13 +++-
 src/tcp-client-response-handler.ts       | 15 +++--
 test/rtu-client-response-handler.test.js | 79 +++++++++++++++++++++++
 test/tcp-response-handler.test.js        | 82 ++++++++++++++++++++++++
 8 files changed, 254 insertions(+), 13 deletions(-)

diff --git a/src/client-response-handler.ts b/src/client-response-handler.ts
index 1225cb4..0a6ebf1 100644
--- a/src/client-response-handler.ts
+++ b/src/client-response-handler.ts
@@ -1,4 +1,5 @@
 import MBAbstractResponse from './abstract-response'
+import { LIMITS } from './constants'
 
 /** Modbus Client Repsonse Handler
  * @abstract
@@ -6,10 +7,23 @@ import MBAbstractResponse from './abstract-response'
 export default abstract class ModbusClientResponseHandler<ResType extends MBAbstractResponse = MBAbstractResponse> {
   protected _buffer: Buffer
   protected abstract _messages: ResType[]
+  protected readonly _maxBufferSize: number
 
-  /** Create new Modbus Client Response Handler */
-  constructor () {
+  /** Create new Modbus Client Response Handler
+   * @param {number} [maxBufferSize=LIMITS.TCP_ADU_MAX] The number of bytes the receive buffer may
+   *   hold without a single complete response being parsable from it. Defaults to the largest
+   *   Modbus/TCP ADU.
+   */
+  constructor (maxBufferSize: number = LIMITS.TCP_ADU_MAX) {
     this._buffer = Buffer.alloc(0)
+    this._maxBufferSize = maxBufferSize
+  }
+
+  /** The number of bytes the receive buffer may hold without a single complete response
+   * being parsable from it.
+   */
+  public get maxBufferSize () {
+    return this._maxBufferSize
   }
 
   /** Process new incoming data and enqueue new modbus responses.
@@ -23,4 +37,26 @@ export default abstract class ModbusClientResponseHandler<ResType extends MBAbst
   public shift () {
     return this._messages.shift()
   }
+
+  /** Discard the receive buffer if it cannot hold the beginning of a valid frame anymore.
+   *
+   * The buffer only ever advances when a complete response parses, and every frame is read
+   * from offset 0. A frame that never completes - a device answering with fewer bytes than
+   * its header announces, a truncated frame, line noise - therefore stays in front of every
+   * following response forever, and the client keeps timing out until the socket is
+   * reconnected.
+   *
+   * Whatever is dropped may contain the beginning of an intact response, in which case the
+   * remainder of that response desyncs the buffer again and is discarded the same way. The
+   * resynchronization therefore is not immediate, but it always converges.
+   *
+   * Call this only once no further response can be parsed from the buffer.
+   */
+  protected _discardOversizedBuffer () {
+    if (this._buffer.length <= this._maxBufferSize) {
+      return
+    }
+
+    this._buffer = Buffer.alloc(0)
+  }
 }
diff --git a/src/constants/limits.ts b/src/constants/limits.ts
index 540f047..1f88ad3 100644
--- a/src/constants/limits.ts
+++ b/src/constants/limits.ts
@@ -8,12 +8,27 @@ const COIL_MAX = 0x01
 
 const ERROR_CODE_THRESHOLD = 0x80
 
+/* The size of the Modbus PDU is limited to 253 bytes. The constraint comes from the
+ * first Modbus implementation on serial line, where the maximum RTU ADU is 256 bytes:
+ * 256 - 1 byte server address - 2 bytes CRC = 253. See Modbus Application Protocol V1.1b3, section 4.1
+ */
+const PDU_MAX = 253
+
+/* Address (1) + PDU (253) + CRC (2) */
+const RTU_ADU_MAX = 256
+
+/* MBAP header (7) + PDU (253) */
+const TCP_ADU_MAX = 260
+
 export const LIMITS = {
   COIL_MAX,
   COIL_MIN,
   ERROR_CODE_THRESHOLD,
+  PDU_MAX,
   REGISTER_MAX,
   REGISTER_MIN,
+  RTU_ADU_MAX,
+  TCP_ADU_MAX,
   UINT16_MAX,
   UINT16_MIN
 } as const
diff --git a/src/modbus-rtu-client.ts b/src/modbus-rtu-client.ts
index 3bb51b4..91000a1 100644
--- a/src/modbus-rtu-client.ts
+++ b/src/modbus-rtu-client.ts
@@ -1,4 +1,5 @@
 
+import { LIMITS } from './constants'
 import MBClient from './modbus-client.js'
 import ModbusRTUClientRequestHandler from './rtu-client-request-handler.js'
 import ModbusRTUClientResponseHandler from './rtu-client-response-handler.js'
@@ -27,12 +28,18 @@ export default class ModbusRTUClient extends MBClient<SerialPort, ModbusRTUReque
    * @param {SerialPort} socket The serial Socket.
    * @param {number} address The address of the serial client.
    * @param {number} [timeout=5000]
+   * @param {number} [maxBufferSize=LIMITS.RTU_ADU_MAX] The number of bytes the receive buffer may hold
    */
-  constructor (socket: SerialPort, address: number, timeout = 5000) {
+  constructor (
+    socket: SerialPort,
+    address: number,
+    timeout = 5000,
+    maxBufferSize: number = LIMITS.RTU_ADU_MAX
+  ) {
     super(socket)
 
     this._requestHandler = new ModbusRTUClientRequestHandler(socket, address, timeout)
-    this._responseHandler = new ModbusRTUClientResponseHandler()
+    this._responseHandler = new ModbusRTUClientResponseHandler(maxBufferSize)
   }
 
   public get slaveId () {
diff --git a/src/modbus-tcp-client.ts b/src/modbus-tcp-client.ts
index f593b1b..5b88ffa 100644
--- a/src/modbus-tcp-client.ts
+++ b/src/modbus-tcp-client.ts
@@ -1,10 +1,10 @@
 
 import { Socket } from 'net'
+import { LIMITS } from './constants'
 import MBClient from './modbus-client.js'
 import MBTCPClientRequestHandler from './tcp-client-request-handler.js'
 import ModbusTCPClientResponseHandler from './tcp-client-response-handler.js'
 import ModbusTCPRequest from './tcp-request.js'
-import ModbusTCPResponse from './tcp-response.js'
 
 /** This client must be initiated with a net.Socket object. The module does not handle reconnections
  * or anything related to keep the connection up in case of an unplugged cable or a closed server. See
@@ -36,13 +36,19 @@ export default class ModbusTCPClient extends MBClient<Socket, ModbusTCPRequest>
    * @param {Socket} socket The TCP Socket.
    * @param {number} [unitId=1] Unit ID
    * @param {number} [timeout=5000] Timeout for requests in ms.
+   * @param {number} [maxBufferSize=LIMITS.TCP_ADU_MAX] The number of bytes the receive buffer may hold
    * @memberof ModbusTCPClient
    */
-  constructor (socket: Socket, unitId: number = 1, timeout: number = 5000) {
+  constructor (
+    socket: Socket,
+    unitId: number = 1,
+    timeout: number = 5000,
+    maxBufferSize: number = LIMITS.TCP_ADU_MAX
+  ) {
     super(socket)
 
     this._requestHandler = new MBTCPClientRequestHandler(socket, unitId, timeout)
-    this._responseHandler = new ModbusTCPClientResponseHandler()
+    this._responseHandler = new ModbusTCPClientResponseHandler(maxBufferSize)
 
     this._unitId = unitId
     this._timeout = timeout
diff --git a/src/rtu-client-response-handler.ts b/src/rtu-client-response-handler.ts
index 71fade0..121de25 100644
--- a/src/rtu-client-response-handler.ts
+++ b/src/rtu-client-response-handler.ts
@@ -1,5 +1,6 @@
 import Debug = require('debug'); const debug = Debug('rtu-response-handler')
 import ModbusClientResponseHandler from './client-response-handler.js'
+import { LIMITS } from './constants'
 import ModbusRTUResponse from './rtu-response.js'
 
 /** Modbus/RTU Client Response Handler
@@ -9,8 +10,12 @@ import ModbusRTUResponse from './rtu-response.js'
 export default class ModbusRTUClientResponseHandler extends ModbusClientResponseHandler<ModbusRTUResponse> {
   protected _messages: ModbusRTUResponse[]
 
-  constructor () {
-    super()
+  /** Create new Modbus/RTU Client Response Handler
+   * @param {number} [maxBufferSize=LIMITS.RTU_ADU_MAX] The number of bytes the receive buffer may
+   *   hold without a single complete response being parsable from it.
+   */
+  constructor (maxBufferSize: number = LIMITS.RTU_ADU_MAX) {
+    super(maxBufferSize)
     this._messages = []
   }
 
@@ -25,6 +30,10 @@ export default class ModbusRTUClientResponseHandler extends ModbusClientResponse
 
       if (!response) {
         debug('not enough data available to parse')
+        /* the remaining bytes are at most one incomplete frame by now, so anything beyond
+         * the largest possible ADU cannot be waiting for more data to arrive
+         */
+        this._discardOversizedBuffer()
         return
       }
 
diff --git a/src/tcp-client-response-handler.ts b/src/tcp-client-response-handler.ts
index a499870..904bbb8 100644
--- a/src/tcp-client-response-handler.ts
+++ b/src/tcp-client-response-handler.ts
@@ -1,5 +1,6 @@
 import Debug = require('debug'); const debug = Debug('tcp-response-handler')
 import ModbusClientResponseHandler from './client-response-handler.js'
+import { LIMITS } from './constants'
 import ModbusTCPResponse from './tcp-response.js'
 
 /** Modbus/TCP Client Response Handler.
@@ -9,10 +10,12 @@ import ModbusTCPResponse from './tcp-response.js'
 export default class ModbusTCPClientResponseHandler extends ModbusClientResponseHandler<ModbusTCPResponse> {
   protected _messages: ModbusTCPResponse[]
 
-  /** Create new Modbus/TCP Client Response Handler */
-  constructor () {
-    super()
-    this._buffer = Buffer.alloc(0)
+  /** Create new Modbus/TCP Client Response Handler
+   * @param {number} [maxBufferSize=LIMITS.TCP_ADU_MAX] The number of bytes the receive buffer may
+   *   hold without a single complete response being parsable from it.
+   */
+  constructor (maxBufferSize: number = LIMITS.TCP_ADU_MAX) {
+    super(maxBufferSize)
     this._messages = []
   }
 
@@ -27,6 +30,10 @@ export default class ModbusTCPClientResponseHandler extends ModbusClientResponse
 
       if (!response) {
         debug('not enough data available to parse')
+        /* the remaining bytes are at most one incomplete frame by now, so anything beyond
+         * the largest possible ADU cannot be waiting for more data to arrive
+         */
+        this._discardOversizedBuffer()
         return
       }
 
diff --git a/test/rtu-client-response-handler.test.js b/test/rtu-client-response-handler.test.js
index 2586cd7..ba08925 100644
--- a/test/rtu-client-response-handler.test.js
+++ b/test/rtu-client-response-handler.test.js
@@ -81,4 +81,83 @@ describe('Modbus/RTU Client Response Tests', function () {
     assert.equal(1, response.body.fc)
     assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
   })
+
+  /* Modbus/RTU has no framing in the payload at all, so line noise or a frame the device
+   * never completed stays in front of every following response. The buffer only ever advances
+   * when a complete response parses and every frame is read from offset 0.
+   */
+  describe('resynchronizing an unparsable buffer', function () {
+    /* function code 0x00 does not exist, so this never parses into a response body */
+    const noise = Buffer.from([0x00, 0x00, 0x00, 0x00])
+
+    const readCoilsResponse = function () {
+      return Buffer.from([
+        0x01,       // address
+        0x01,       // function code
+        0x02,       // byte count
+        0xdd,       // coils
+        0x00,
+        0xCD, 0xAB  // crc
+      ])
+    }
+
+    it('should default to the largest possible Modbus/RTU ADU', function () {
+      assert.equal(256, new ModbusRTUClientResponseHandler().maxBufferSize)
+      assert.equal(64, new ModbusRTUClientResponseHandler(64).maxBufferSize)
+    })
+
+    it('should discard the buffer when no response parses from more than maxBufferSize bytes', function () {
+      handler = new ModbusRTUClientResponseHandler(12)
+
+      handler.handleData(noise)
+      assert.equal(undefined, handler.shift(), 'noise must not parse into a response')
+
+      /* 11 bytes, below the limit, the noise keeps this response from parsing */
+      handler.handleData(readCoilsResponse())
+      assert.equal(undefined, handler.shift(), 'the leading noise must desync this response')
+
+      /* 18 bytes, beyond the limit, the prefix provably is not the start of a frame */
+      handler.handleData(readCoilsResponse())
+      assert.equal(undefined, handler.shift())
+
+      /* the buffer was dropped, so this response is aligned again */
+      handler.handleData(readCoilsResponse())
+
+      const response = handler.shift()
+
+      assert.ok(response !== undefined, 'the handler did not resynchronize')
+      assert.equal(1, response.address)
+      assert.equal(1, response.body.fc)
+      assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
+    })
+
+    it('should keep a response that is still being received', function () {
+      /* room for exactly one ADU, so the incomplete frame sits right at the limit */
+      handler = new ModbusRTUClientResponseHandler(7)
+      const responseBuffer = readCoilsResponse()
+
+      handler.handleData(responseBuffer.slice(0, 4))
+      assert.equal(undefined, handler.shift())
+
+      handler.handleData(responseBuffer.slice(4))
+
+      const response = handler.shift()
+
+      assert.ok(response !== undefined, 'a frame at the limit must not be discarded')
+      assert.equal(1, response.body.fc)
+    })
+
+    it('should resynchronize with the default limit as well', function () {
+      handler.handleData(noise)
+
+      let response
+      for (let i = 0; i < 45 && response === undefined; i += 1) {
+        handler.handleData(readCoilsResponse())
+        response = handler.shift()
+      }
+
+      assert.ok(response !== undefined, 'the handler never resynchronized')
+      assert.equal(1, response.body.fc)
+    })
+  })
 })
diff --git a/test/tcp-response-handler.test.js b/test/tcp-response-handler.test.js
index df832fb..36ee241 100644
--- a/test/tcp-response-handler.test.js
+++ b/test/tcp-response-handler.test.js
@@ -184,4 +184,86 @@ describe('Modbus/TCP Client Response Handler Tests', function () {
     assert.equal(1, response.body.fc)
     assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
   })
+
+  /* A device that answers with fewer bytes than its MBAP header announces leaves a prefix in
+   * the receive buffer. The buffer only ever advances when a complete response parses and
+   * every frame is read from offset 0, so that prefix desyncs every following response until
+   * the socket is reconnected.
+   */
+  describe('resynchronizing an unparsable buffer', function () {
+    /* the beginning of a response the device never completed */
+    const truncatedFrame = Buffer.from([0x00, 0x2a, 0x00, 0x00])
+
+    const readCoilsResponse = function () {
+      return Buffer.from([
+        0x00, 0x01, // transaction id
+        0x00, 0x00, // protocol
+        0x00, 0x05, // length
+        0x03,       // unit id
+        0x01,       // function code
+        0x02,       // byte count
+        0xdd,       // coils
+        0x00
+      ])
+    }
+
+    it('should default to the largest possible Modbus/TCP ADU', function () {
+      assert.equal(260, new TCPResponseHandler().maxBufferSize)
+      assert.equal(64, new TCPResponseHandler(64).maxBufferSize)
+    })
+
+    it('should discard the buffer when no response parses from more than maxBufferSize bytes', function () {
+      handler = new TCPResponseHandler(20)
+
+      handler.handleData(truncatedFrame)
+      assert.equal(undefined, handler.shift(), 'a truncated frame must not parse')
+
+      /* 15 bytes, below the limit, the stale prefix keeps this response from parsing */
+      handler.handleData(readCoilsResponse())
+      assert.equal(undefined, handler.shift(), 'the stale prefix must desync this response')
+
+      /* 26 bytes, beyond the limit, the prefix provably is not the start of a frame */
+      handler.handleData(readCoilsResponse())
+      assert.equal(undefined, handler.shift())
+
+      /* the buffer was dropped, so this response is aligned again */
+      handler.handleData(readCoilsResponse())
+
+      const response = handler.shift()
+
+      assert.ok(response !== undefined, 'the handler did not resynchronize')
+      assert.equal(1, response.id)
+      assert.equal(1, response.body.fc)
+      assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
+    })
+
+    it('should keep a response that is still being received', function () {
+      /* room for exactly one ADU, so the incomplete frame sits right at the limit */
+      handler = new TCPResponseHandler(11)
+      const responseBuffer = readCoilsResponse()
+
+      handler.handleData(responseBuffer.slice(0, 6))
+      assert.equal(undefined, handler.shift())
+
+      handler.handleData(responseBuffer.slice(6))
+
+      const response = handler.shift()
+
+      assert.ok(response !== undefined, 'a frame at the limit must not be discarded')
+      assert.equal(1, response.body.fc)
+    })
+
+    it('should resynchronize with the default limit as well', function () {
+      handler.handleData(truncatedFrame)
+
+      let response
+      for (let i = 0; i < 30 && response === undefined; i += 1) {
+        handler.handleData(readCoilsResponse())
+        response = handler.shift()
+      }
+
+      assert.ok(response !== undefined, 'the handler never resynchronized')
+      assert.equal(1, response.body.fc)
+    })
+  })
 })

From 375f2c44e2d5f185aac05972a9ac40784d54670d Mon Sep 17 00:00:00 2001
From: Barneey96 <barnabas.ajtay@proton.me>
Date: Tue, 15 Sep 2026 10:25:29 +0200
Subject: [PATCH 2/7] fix: RTU CRC validation & fast resynchronization based on
 TCP MBAP header

---
 src/constants/limits.ts                  | 11 +++
 src/rtu-client-response-handler.ts       | 49 +++++++++++-
 src/rtu-response.ts                      | 40 ++++++++--
 src/tcp-client-response-handler.ts       | 48 +++++++++++-
 src/tcp-response.ts                      | 12 +++
 test/rtu-client-response-handler.test.js | 93 +++++++++++++++++++----
 test/tcp-response-handler.test.js        | 94 ++++++++++++++++++------
 7 files changed, 300 insertions(+), 47 deletions(-)

diff --git a/src/constants/limits.ts b/src/constants/limits.ts
index 1f88ad3..e0565cb 100644
--- a/src/constants/limits.ts
+++ b/src/constants/limits.ts
@@ -20,10 +20,21 @@ const RTU_ADU_MAX = 256
 /* MBAP header (7) + PDU (253) */
 const TCP_ADU_MAX = 260
 
+/* Transaction id (2) + protocol id (2) + length (2). The length field that follows counts the
+ * unit identifier and the PDU, so a complete Modbus/TCP ADU is MBAP_PREFIX_LENGTH + length and
+ * the length field itself can never leave 2 .. PDU_MAX + 1.
+ */
+const MBAP_PREFIX_LENGTH = 6
+
+/* The protocol identifier reserved for Modbus in the MBAP header */
+const MBAP_PROTOCOL_ID = 0x0000
+
 export const LIMITS = {
   COIL_MAX,
   COIL_MIN,
   ERROR_CODE_THRESHOLD,
+  MBAP_PREFIX_LENGTH,
+  MBAP_PROTOCOL_ID,
   PDU_MAX,
   REGISTER_MAX,
   REGISTER_MIN,
diff --git a/src/rtu-client-response-handler.ts b/src/rtu-client-response-handler.ts
index 121de25..2640dc0 100644
--- a/src/rtu-client-response-handler.ts
+++ b/src/rtu-client-response-handler.ts
@@ -1,5 +1,6 @@
-import Debug = require('debug'); const debug = Debug('rtu-response-handler')
+import Debug from 'debug'; const debug = Debug('rtu-response-handler')
 import ModbusClientResponseHandler from './client-response-handler.js'
+import { isFunctionCode } from './codes'
 import { LIMITS } from './constants'
 import ModbusRTUResponse from './rtu-response.js'
 
@@ -29,6 +30,10 @@ export default class ModbusRTUClientResponseHandler extends ModbusClientResponse
       const response = ModbusRTUResponse.fromBuffer(this._buffer)
 
       if (!response) {
+        if (this._resynchronize()) {
+          continue
+        }
+
         debug('not enough data available to parse')
         /* the remaining bytes are at most one incomplete frame by now, so anything beyond
          * the largest possible ADU cannot be waiting for more data to arrive
@@ -37,6 +42,17 @@ export default class ModbusRTUClientResponseHandler extends ModbusClientResponse
         return
       }
 
+      if (response.corrupted) {
+        /* The CRC covers the whole frame, so a mismatch proves offset 0 is not where this
+         * response starts. Drop a single byte rather than the frame the parser believed it
+         * saw: its byte count was derived from bytes we just proved untrustworthy, so
+         * skipping it could swallow the real frame that begins in the middle of it.
+         */
+        debug('crc mismatch, skipping one byte to resynchronize')
+        this._buffer = this._buffer.slice(1)
+        continue
+      }
+
       debug('crc', response.crc)
 
       debug('reset buffer from', this._buffer.length, 'to', (this._buffer.length - response.byteCount))
@@ -51,4 +67,35 @@ export default class ModbusRTUClientResponseHandler extends ModbusClientResponse
   public shift () {
     return this._messages.shift()
   }
+
+  /** Drop the leading byte when it provably cannot begin a response, and report whether it did.
+   *
+   * A frame that failed to parse is usually just still arriving, so the buffer has to be left
+   * alone. The one thing that can be decided from an incomplete frame is its function code: the
+   * parser accepts a body only for a known function code, or for an exception whose underlying
+   * code is known, so anything else can never parse no matter how many bytes follow it. Waiting
+   * for the buffer to outgrow an ADU before dropping it would stall every request in the
+   * meantime, and each stalled request costs a full timeout.
+   *
+   * Only ever one byte: the real frame may start anywhere inside what is being skipped.
+   */
+  private _resynchronize () {
+    if (this._buffer.length < 2) {
+      /* the function code has not arrived yet */
+      return false
+    }
+
+    const fc = this._buffer.readUInt8(1)
+    const isException = fc > LIMITS.ERROR_CODE_THRESHOLD &&
+      isFunctionCode(fc - LIMITS.ERROR_CODE_THRESHOLD)
+
+    if (isFunctionCode(fc) || isException) {
+      return false
+    }
+
+    debug('function code', fc, 'cannot start a response, skipping one byte to resynchronize')
+    this._buffer = this._buffer.slice(1)
+
+    return true
+  }
 }
diff --git a/src/rtu-response.ts b/src/rtu-response.ts
index c903738..09340c2 100644
--- a/src/rtu-response.ts
+++ b/src/rtu-response.ts
@@ -17,6 +17,14 @@ export default class ModbusRTUResponse<ResBody extends ModbusResponseBody = Modb
     return this._crc
   }
 
+  /** True when the frame's CRC does not match its payload, which means these bytes are not a
+   * trustworthy response - either the buffer lost its frame alignment or the line corrupted
+   * the message. Mirrors ModbusRTURequest#corrupted.
+   */
+  get corrupted () {
+    return this._corrupted
+  }
+
   get body () {
     return this._body
   }
@@ -50,7 +58,7 @@ export default class ModbusRTUResponse<ResBody extends ModbusResponseBody = Modb
   }
 
   public static fromBuffer (buffer: Buffer) {
-    if (buffer.length < 1) {
+    if (buffer.length < 1 /* address */ + 2 /* CRC */) {
       return null
     }
 
@@ -64,25 +72,47 @@ export default class ModbusRTUResponse<ResBody extends ModbusResponseBody = Modb
       return null
     }
 
-    let crc
+    const payloadLength = 1 /* address */ + body.byteCount
+
+    let actualCrc
     try {
-      crc = buffer.readUInt16LE(1 + body.byteCount)
+      actualCrc = buffer.readUInt16LE(payloadLength)
     } catch (e) {
       debug('If NoSuchIndexException, it is probably serial and not all data has arrived')
       return null
     }
 
-    return new ModbusRTUResponse(address, crc, body)
+    /* Modbus/RTU carries no framing in the payload, so the CRC is the only evidence that the
+     * bytes really start a response here. Without it a buffer that lost its alignment parses
+     * into a structurally valid but entirely fabricated response - a stray leading byte turns
+     * a read holding registers answer into a read coils answer with invented values.
+     */
+    const expectedCrc = CRC.crc16modbus(buffer.slice(0, payloadLength))
+    const corrupted = (expectedCrc !== actualCrc)
+
+    if (corrupted) {
+      debug('crc mismatch, expected', expectedCrc, 'got', actualCrc)
+    }
+
+    return new ModbusRTUResponse(address, actualCrc, body, corrupted)
   }
   public _address: number
   public _crc: number | undefined
   protected _body: ResBody
+  protected _corrupted: boolean
 
-  constructor (address: number, crc: number | undefined, body: ResBody) {
+  /** Create new Modbus/RTU Response Object.
+   * @param {number} address Address/Unit ID
+   * @param {number} [crc] CRC of the frame, undefined until createPayload () calculates it
+   * @param {ModbusResponseBody} body Modbus response body object
+   * @param {boolean} [corrupted=false] Whether the frame's CRC failed to verify
+   */
+  constructor (address: number, crc: number | undefined, body: ResBody, corrupted: boolean = false) {
     super()
     this._address = address
     this._crc = crc
     this._body = body
+    this._corrupted = corrupted
   }
 
   public createPayload () {
diff --git a/src/tcp-client-response-handler.ts b/src/tcp-client-response-handler.ts
index 904bbb8..e190465 100644
--- a/src/tcp-client-response-handler.ts
+++ b/src/tcp-client-response-handler.ts
@@ -29,9 +29,13 @@ export default class ModbusTCPClientResponseHandler extends ModbusClientResponse
       const response = ModbusTCPResponse.fromBuffer(this._buffer)
 
       if (!response) {
+        if (this._resynchronize()) {
+          continue
+        }
+
         debug('not enough data available to parse')
-        /* the remaining bytes are at most one incomplete frame by now, so anything beyond
-         * the largest possible ADU cannot be waiting for more data to arrive
+        /* nothing could be skipped, so the bytes left are one frame that is still arriving;
+         * anything beyond the largest possible ADU cannot be waiting for more data
          */
         this._discardOversizedBuffer()
         return
@@ -52,4 +56,44 @@ export default class ModbusTCPClientResponseHandler extends ModbusClientResponse
       this._buffer = this._buffer.slice(response.byteCount)
     } while (1)
   }
+
+  /** Move the buffer to the next plausible frame after a response failed to parse and report
+   * whether anything was skipped.
+   *
+   * Unlike a raw serial stream, Modbus/TCP prefixes every frame with an MBAP header stating the
+   * exact frame length, so a desynchronized buffer can normally be realigned in a single step
+   * rather than by waiting for it to outgrow an ADU. A frame that has fully arrived and still
+   * does not parse - an unimplemented function code, a corrupt payload - is skipped whole,
+   * because its header told us exactly where the next one begins.
+   *
+   * Bytes that cannot be an MBAP header at all cost a single byte each instead: the real frame
+   * may begin anywhere inside them, so skipping further could swallow it.
+   */
+  private _resynchronize () {
+    if (this._buffer.length < LIMITS.MBAP_PREFIX_LENGTH) {
+      /* the header itself is still arriving */
+      return false
+    }
+
+    const protocol = this._buffer.readUInt16BE(2)
+    const length = this._buffer.readUInt16BE(4)
+
+    if (protocol !== LIMITS.MBAP_PROTOCOL_ID || length < 2 || length > LIMITS.PDU_MAX + 1) {
+      debug('implausible mbap header, skipping one byte to resynchronize')
+      this._buffer = this._buffer.slice(1)
+      return true
+    }
+
+    const frameLength = LIMITS.MBAP_PREFIX_LENGTH + length
+
+    if (this._buffer.length < frameLength) {
+      /* the announced frame is still on its way */
+      return false
+    }
+
+    debug('skipping a complete but unparsable frame of', frameLength, 'bytes')
+    this._buffer = this._buffer.slice(frameLength)
+
+    return true
+  }
 }
diff --git a/src/tcp-response.ts b/src/tcp-response.ts
index 8fbb8c1..07ff40d 100644
--- a/src/tcp-response.ts
+++ b/src/tcp-response.ts
@@ -1,5 +1,6 @@
 import Debug = require('debug'); const debug = Debug('tcp-response')
 import ModbusAbstractResponse from './abstract-response.js'
+import { LIMITS } from './constants'
 import { ModbusRequestBody } from './request'
 import ModbusResponseBody from './response/response-body.js'
 import ResponseFactory from './response/response-factory.js'
@@ -75,6 +76,17 @@ export default class ModbusTCPResponse<ResBody extends ModbusResponseBody = Modb
       const id = buffer.readUInt16BE(0)
       const protocol = buffer.readUInt16BE(2)
       const length = buffer.readUInt16BE(4)
+
+      /* The length field states exactly how many bytes follow it, and Buffer#slice silently
+       * clamps to the end of the buffer. Without this guard a device that answers with fewer
+       * bytes than it announced yields a response parsed from data that never arrived, whose
+       * byteCount then advances the receive buffer past its own end.
+       */
+      if (buffer.length < LIMITS.MBAP_PREFIX_LENGTH + length) {
+        debug('the announced frame has not arrived completely yet')
+        return null
+      }
+
       const unitId = buffer.readUInt8(6)
 
       debug('tcp header complete, id', id, 'protocol', protocol, 'length', length, 'unitId', unitId)
diff --git a/test/rtu-client-response-handler.test.js b/test/rtu-client-response-handler.test.js
index ba08925..319dc27 100644
--- a/test/rtu-client-response-handler.test.js
+++ b/test/rtu-client-response-handler.test.js
@@ -20,7 +20,7 @@ describe('Modbus/RTU Client Response Tests', function () {
       0x02,       // byte count
       0xdd,       // coils
       0x00,
-      0xCD, 0xAB // crc
+      0xE0, 0xAC // crc
     ])
 
     handler.handleData(responseBuffer)
@@ -30,7 +30,8 @@ describe('Modbus/RTU Client Response Tests', function () {
     assert.ok(response !== null)
     assert.equal(1, response.address)
     assert.equal(1, response.body.fc)
-    assert.equal(0xABCD, response.crc)
+    assert.equal(0xACE0, response.crc)
+    assert.equal(false, response.corrupted)
     assert.equal(7, response.byteCount)
 
     assert.equal(1, response.body.fc)
@@ -41,7 +42,7 @@ describe('Modbus/RTU Client Response Tests', function () {
       0x01,       // address
       0x81,       // exception code for fc 0x01
       0x01,       // exception code ILLEGAL FUNCTION
-      0x00, 0x00  // crc
+      0x81, 0x90  // crc
     ])
 
     handler.handleData(responseBuffer)
@@ -63,7 +64,7 @@ describe('Modbus/RTU Client Response Tests', function () {
       0x02,       // byte count
       0xdd,       // coils
       0x00,
-      0x00, 0x00  // crc
+      0xE0, 0xAC  // crc
     ])
 
     handler.handleData(responseBufferA)
@@ -82,13 +83,17 @@ describe('Modbus/RTU Client Response Tests', function () {
     assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
   })
 
-  /* Modbus/RTU has no framing in the payload at all, so line noise or a frame the device
-   * never completed stays in front of every following response. The buffer only ever advances
-   * when a complete response parses and every frame is read from offset 0.
+  /* Modbus/RTU carries no framing in the payload, so line noise or a frame the device never
+   * completed stays in front of every following response: the buffer only ever advances when a
+   * complete response parses and every frame is read from offset 0. The CRC is the only
+   * evidence that a frame really starts where the parser is looking.
    */
   describe('resynchronizing an unparsable buffer', function () {
-    /* function code 0x00 does not exist, so this never parses into a response body */
-    const noise = Buffer.from([0x00, 0x00, 0x00, 0x00])
+    /* Address, function code 0x03 and a byte count of 250: a perfectly plausible start that the
+     * device never finished. The function code is real, so nothing but the buffer limit can
+     * prove these bytes will never become a frame.
+     */
+    const stalledFrame = Buffer.from([0x01, 0x03, 0xfa])
 
     const readCoilsResponse = function () {
       return Buffer.from([
@@ -97,7 +102,19 @@ describe('Modbus/RTU Client Response Tests', function () {
         0x02,       // byte count
         0xdd,       // coils
         0x00,
-        0xCD, 0xAB  // crc
+        0xE0, 0xAC  // crc
+      ])
+    }
+
+    /* 2 registers, 0x000A and 0x0014 */
+    const readHoldingRegistersResponse = function () {
+      return Buffer.from([
+        0x01,       // address
+        0x03,       // function code
+        0x04,       // byte count
+        0x00, 0x0A, // register 0
+        0x00, 0x14, // register 1
+        0xDA, 0x3E  // crc
       ])
     }
 
@@ -106,17 +123,61 @@ describe('Modbus/RTU Client Response Tests', function () {
       assert.equal(64, new ModbusRTUClientResponseHandler(64).maxBufferSize)
     })
 
+    /* Without the CRC check a single stray byte turns this read holding registers answer into a
+     * read coils answer with invented values, and the handler hands it to the caller as a
+     * genuine reading - a wrong measurement is far worse than a timeout.
+     */
+    it('should not deliver a misaligned frame as a valid response', function () {
+      handler.handleData(Buffer.concat([
+        Buffer.from([0x01]), // a stray byte in front of an otherwise intact frame
+        readHoldingRegistersResponse()
+      ]))
+
+      const response = handler.shift()
+
+      assert.ok(response !== undefined, 'the handler did not resynchronize')
+      assert.equal(3, response.body.fc, 'the misaligned read coils parse must not be delivered')
+      assert.equal(1, response.address)
+      assert.deepEqual([10, 20], response.body.valuesAsArray)
+      assert.equal(undefined, handler.shift(), 'only one response may be delivered')
+    })
+
+    it('should resynchronize within the same chunk the stray bytes arrive in', function () {
+      handler.handleData(Buffer.concat([
+        Buffer.from([0xff, 0xff]),
+        readCoilsResponse()
+      ]))
+
+      const response = handler.shift()
+
+      assert.ok(response !== undefined, 'the frame after the noise must still be found')
+      assert.equal(1, response.body.fc)
+      assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
+    })
+
+    it('should drop a frame whose crc does not verify', function () {
+      const corrupt = readCoilsResponse()
+      corrupt[3] = 0xab // flip a coil byte, leaving the crc stale
+
+      handler.handleData(corrupt)
+
+      assert.equal(undefined, handler.shift(), 'a crc failure must never reach the caller')
+    })
+
+    /* A frame that stalled behind a valid function code carries no crc to check yet and no
+     * length to measure, so Modbus/RTU still needs the buffer limit as its backstop.
+     */
     it('should discard the buffer when no response parses from more than maxBufferSize bytes', function () {
       handler = new ModbusRTUClientResponseHandler(12)
 
-      handler.handleData(noise)
-      assert.equal(undefined, handler.shift(), 'noise must not parse into a response')
+      handler.handleData(stalledFrame)
+      assert.equal(undefined, handler.shift(), 'an unfinished frame must not parse')
 
-      /* 11 bytes, below the limit, the noise keeps this response from parsing */
+      /* 10 bytes, below the limit, the stalled frame keeps this response from parsing */
       handler.handleData(readCoilsResponse())
-      assert.equal(undefined, handler.shift(), 'the leading noise must desync this response')
+      assert.equal(undefined, handler.shift(), 'the stalled frame must desync this response')
 
-      /* 18 bytes, beyond the limit, the prefix provably is not the start of a frame */
+      /* 17 bytes, beyond the limit, the prefix provably is not the start of a frame */
       handler.handleData(readCoilsResponse())
       assert.equal(undefined, handler.shift())
 
@@ -148,7 +209,7 @@ describe('Modbus/RTU Client Response Tests', function () {
     })
 
     it('should resynchronize with the default limit as well', function () {
-      handler.handleData(noise)
+      handler.handleData(stalledFrame)
 
       let response
       for (let i = 0; i < 45 && response === undefined; i += 1) {
diff --git a/test/tcp-response-handler.test.js b/test/tcp-response-handler.test.js
index 36ee241..c15eb39 100644
--- a/test/tcp-response-handler.test.js
+++ b/test/tcp-response-handler.test.js
@@ -185,10 +185,12 @@ describe('Modbus/TCP Client Response Handler Tests', function () {
     assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
   })
 
-  /* A device that answers with fewer bytes than its MBAP header announces leaves a prefix in
-   * the receive buffer. The buffer only ever advances when a complete response parses and
-   * every frame is read from offset 0, so that prefix desyncs every following response until
-   * the socket is reconnected.
+  /* A device that answers with fewer bytes than its MBAP header announces, or with a frame this
+   * library has no parser for, leaves a prefix in the receive buffer. The buffer only ever
+   * advances when a complete response parses and every frame is read from offset 0, so that
+   * prefix desyncs every following response until the handler realigns itself. Unlike a serial
+   * stream, Modbus/TCP states the frame length in its header, so realigning rarely costs more
+   * than the damaged frame itself.
    */
   describe('resynchronizing an unparsable buffer', function () {
     /* the beginning of a response the device never completed */
@@ -207,26 +209,44 @@ describe('Modbus/TCP Client Response Handler Tests', function () {
       ])
     }
 
+    /* A complete, well formed frame carrying function code 0x11 (Report Server ID), which this
+     * library has no response parser for. Its header still says exactly where it ends.
+     */
+    const unsupportedFunctionResponse = function () {
+      return Buffer.from([
+        0x00, 0x07, // transaction id
+        0x00, 0x00, // protocol
+        0x00, 0x04, // length
+        0x03,       // unit id
+        0x11,       // function code
+        0x02,       // byte count
+        0xaa
+      ])
+    }
+
     it('should default to the largest possible Modbus/TCP ADU', function () {
       assert.equal(260, new TCPResponseHandler().maxBufferSize)
       assert.equal(64, new TCPResponseHandler(64).maxBufferSize)
     })
 
-    it('should discard the buffer when no response parses from more than maxBufferSize bytes', function () {
-      handler = new TCPResponseHandler(20)
+    it('should skip a complete but unparsable frame in a single step', function () {
+      handler.handleData(Buffer.concat([
+        unsupportedFunctionResponse(),
+        readCoilsResponse()
+      ]))
+
+      const response = handler.shift()
 
+      assert.ok(response !== undefined, 'the frame behind the unparsable one must be found')
+      assert.equal(1, response.id)
+      assert.equal(1, response.body.fc)
+      assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
+    })
+
+    it('should resynchronize as soon as the next response arrives', function () {
       handler.handleData(truncatedFrame)
       assert.equal(undefined, handler.shift(), 'a truncated frame must not parse')
 
-      /* 15 bytes, below the limit, the stale prefix keeps this response from parsing */
-      handler.handleData(readCoilsResponse())
-      assert.equal(undefined, handler.shift(), 'the stale prefix must desync this response')
-
-      /* 26 bytes, beyond the limit, the prefix provably is not the start of a frame */
-      handler.handleData(readCoilsResponse())
-      assert.equal(undefined, handler.shift())
-
-      /* the buffer was dropped, so this response is aligned again */
       handler.handleData(readCoilsResponse())
 
       const response = handler.shift()
@@ -237,6 +257,18 @@ describe('Modbus/TCP Client Response Handler Tests', function () {
       assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
     })
 
+    /* Buffer#slice clamps silently, so without the length guard this parses into a response
+     * built from bytes that never arrived.
+     */
+    it('should not parse a frame that announced more bytes than it sent', function () {
+      const lying = readCoilsResponse()
+      lying.writeUInt16BE(0x20, 4) // claim 32 bytes follow, then send 5
+
+      handler.handleData(lying)
+
+      assert.equal(undefined, handler.shift(), 'an incomplete frame must never reach the caller')
+    })
+
     it('should keep a response that is still being received', function () {
       /* room for exactly one ADU, so the incomplete frame sits right at the limit */
       handler = new TCPResponseHandler(11)
@@ -253,16 +285,32 @@ describe('Modbus/TCP Client Response Handler Tests', function () {
       assert.equal(1, response.body.fc)
     })
 
-    it('should resynchronize with the default limit as well', function () {
-      handler.handleData(truncatedFrame)
+    /* A header that is plausible and announces a frame still on its way cannot be skipped - the
+     * rest may genuinely be in flight - so the buffer limit remains the backstop for a device
+     * that stops halfway through a frame it announced.
+     */
+    it('should discard the buffer when no response parses from more than maxBufferSize bytes', function () {
+      handler = new TCPResponseHandler(20)
+
+      /* announces 100 bytes and then stops */
+      handler.handleData(Buffer.from([0x00, 0x2a, 0x00, 0x00, 0x00, 0x64, 0x03]))
+      assert.equal(undefined, handler.shift(), 'a stalled frame must not parse')
+
+      /* 18 bytes, below the limit, the stalled frame keeps this response from parsing */
+      handler.handleData(readCoilsResponse())
+      assert.equal(undefined, handler.shift(), 'the stalled frame must desync this response')
+
+      /* 29 bytes, beyond the limit, so the buffer is dropped */
+      handler.handleData(readCoilsResponse())
+      assert.equal(undefined, handler.shift())
+
+      /* the buffer was dropped, so this response is aligned again */
+      handler.handleData(readCoilsResponse())
 
-      let response
-      for (let i = 0; i < 30 && response === undefined; i += 1) {
-        handler.handleData(readCoilsResponse())
-        response = handler.shift()
-      }
+      const response = handler.shift()
 
-      assert.ok(response !== undefined, 'the handler never resynchronized')
+      assert.ok(response !== undefined, 'the handler did not resynchronize')
+      assert.equal(1, response.id)
       assert.equal(1, response.body.fc)
     })
   })

From 686c5220076799e85ef52b3c709d7de6ba593c32 Mon Sep 17 00:00:00 2001
From: Barneey96 <barnabas.ajtay@proton.me>
Date: Tue, 15 Sep 2026 11:20:17 +0200
Subject: [PATCH 3/7] chore: bump version

---
 package-lock.json | 4 ++--
 package.json      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 3beabd3..6d8f388 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "jsmodbus",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "jsmodbus",
-      "version": "5.0.0",
+      "version": "5.0.1",
       "license": "MIT",
       "dependencies": {
         "commander": "^11.1.0",
diff --git a/package.json b/package.json
index a992265..5e93f4f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jsmodbus",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "Implementation for the Serial/TCP Modbus protocol.",
   "author": "Stefan Poeter <stefan.poeter@cloud-automation.de>",
   "main": "./dist/modbus.js",

From 7590c5a40d84b416c7543d927263557382fb865c Mon Sep 17 00:00:00 2001
From: Barneey96 <barnabas.ajtay@proton.me>
Date: Tue, 15 Sep 2026 11:21:39 +0200
Subject: [PATCH 4/7] fix: the body must fill length - 1 exactly

---
 src/rtu-response.ts                      | 12 +++-
 src/tcp-response.ts                      | 10 ++++
 test/rtu-client-response-handler.test.js | 51 ++++++++++++++++-
 test/tcp-response-handler.test.js        | 72 ++++++++++++++++++++++++
 4 files changed, 140 insertions(+), 5 deletions(-)

diff --git a/src/rtu-response.ts b/src/rtu-response.ts
index 09340c2..3176368 100644
--- a/src/rtu-response.ts
+++ b/src/rtu-response.ts
@@ -83,9 +83,15 @@ export default class ModbusRTUResponse<ResBody extends ModbusResponseBody = Modb
     }
 
     /* Modbus/RTU carries no framing in the payload, so the CRC is the only evidence that the
-     * bytes really start a response here. Without it a buffer that lost its alignment parses
-     * into a structurally valid but entirely fabricated response - a stray leading byte turns
-     * a read holding registers answer into a read coils answer with invented values.
+     * bytes really start a response here: a buffer that lost its alignment otherwise parses
+     * into a structurally valid but fabricated response - a stray leading byte turns a read
+     * holding registers answer into a read coils answer with invented values.
+     *
+     * ModbusRTUClientRequestHandler verifies the crc again and rejects such a response, so it
+     * never reaches the application, but by then these bytes have already been consumed and the
+     * stream stays out of step - the request is lost rather than recovered. Reporting the
+     * mismatch here instead lets the response handler step over the stray byte and go on to
+     * find the real frame.
      */
     const expectedCrc = CRC.crc16modbus(buffer.slice(0, payloadLength))
     const corrupted = (expectedCrc !== actualCrc)
diff --git a/src/tcp-response.ts b/src/tcp-response.ts
index 07ff40d..106f556 100644
--- a/src/tcp-response.ts
+++ b/src/tcp-response.ts
@@ -99,6 +99,16 @@ export default class ModbusTCPResponse<ResBody extends ModbusResponseBody = Modb
         return null
       }
 
+      /* The length field counts the unit identifier plus the PDU, so the body has to consume
+       * the announced payload exactly. A body that stops short means these bytes are not the
+       * frame the header described - most often noise that happened to look like an MBAP
+       * header, which would otherwise be handed on as a short but structurally valid response.
+       */
+      if (body.byteCount !== length - 1) {
+        debug('body of', body.byteCount, 'bytes does not fill the announced', length - 1)
+        return null
+      }
+
       debug('buffer contains a valid response body')
 
       return new ModbusTCPResponse(id, protocol, length, unitId, body)
diff --git a/test/rtu-client-response-handler.test.js b/test/rtu-client-response-handler.test.js
index 319dc27..f926826 100644
--- a/test/rtu-client-response-handler.test.js
+++ b/test/rtu-client-response-handler.test.js
@@ -124,8 +124,10 @@ describe('Modbus/RTU Client Response Tests', function () {
     })
 
     /* Without the CRC check a single stray byte turns this read holding registers answer into a
-     * read coils answer with invented values, and the handler hands it to the caller as a
-     * genuine reading - a wrong measurement is far worse than a timeout.
+     * read coils answer with invented values. The client rejects that further up, so no wrong
+     * reading ever reaches the application, but only after these bytes were consumed - the
+     * request is lost instead of recovered. Verifying the crc here lets the handler step over
+     * the stray byte and return the answer the device actually sent.
      */
     it('should not deliver a misaligned frame as a valid response', function () {
       handler.handleData(Buffer.concat([
@@ -220,5 +222,50 @@ describe('Modbus/RTU Client Response Tests', function () {
       assert.ok(response !== undefined, 'the handler never resynchronized')
       assert.equal(1, response.body.fc)
     })
+
+    /* The cases above pin individual scenarios, but the property that actually matters is a
+     * global one: wherever the stream is cut and whatever lands between frames, a response that
+     * reaches the caller must be the one the device sent. The seed is fixed so a failure is
+     * reproducible.
+     */
+    it('should never deliver a corrupted response under random noise', function () {
+      let seed = 0x2f6e2b1
+      const rnd = function (n) { seed = (seed * 1103515245 + 12345) & 0x7fffffff; return seed % n }
+
+      handler = new ModbusRTUClientResponseHandler()
+
+      let delivered = 0
+
+      for (let round = 0; round < 2000; round += 1) {
+        if (rnd(3) === 0) {
+          const noise = Buffer.alloc(1 + rnd(12))
+          for (let i = 0; i < noise.length; i += 1) { noise[i] = rnd(256) }
+          handler.handleData(noise)
+        }
+
+        const frame = readCoilsResponse()
+
+        if (rnd(2) === 0) {
+          const at = 1 + rnd(frame.length - 1)
+          handler.handleData(frame.slice(0, at))
+          handler.handleData(frame.slice(at))
+        } else {
+          handler.handleData(frame)
+        }
+
+        let response
+        while ((response = handler.shift()) !== undefined) {
+          delivered += 1
+          assert.equal(1, response.body.fc, 'a response built from noise reached the caller')
+          assert.deepEqual(
+            [1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0],
+            response.body.valuesAsArray,
+            'a response built from noise reached the caller'
+          )
+        }
+      }
+
+      assert.ok(delivered > 1500, `expected the handler to keep recovering, got ${delivered}`)
+    })
   })
 })
diff --git a/test/tcp-response-handler.test.js b/test/tcp-response-handler.test.js
index c15eb39..aa27894 100644
--- a/test/tcp-response-handler.test.js
+++ b/test/tcp-response-handler.test.js
@@ -269,6 +269,33 @@ describe('Modbus/TCP Client Response Handler Tests', function () {
       assert.equal(undefined, handler.shift(), 'an incomplete frame must never reach the caller')
     })
 
+    /* The frame has fully arrived, but the body stops short of the length the header announced,
+     * which is how noise that happens to look like an MBAP header presents itself.
+     */
+    it('should not parse a frame whose body does not fill the announced length', function () {
+      handler.handleData(Buffer.concat([
+        Buffer.from([
+          0x00, 0x01, // transaction id
+          0x00, 0x00, // protocol
+          0x00, 0x08, // length: claims a 7 byte pdu
+          0x03,       // unit id
+          0x01,       // function code
+          0x02,       // byte count
+          0xdd,       // coils
+          0x00,
+          0x00, 0x00, 0x00 // padding the body never accounts for
+        ]),
+        readCoilsResponse()
+      ]))
+
+      const response = handler.shift()
+
+      assert.ok(response !== undefined, 'the frame behind the bad one must still be found')
+      assert.equal(1, response.id, 'the short body must not be delivered')
+      assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
+      assert.equal(undefined, handler.shift(), 'only one response may be delivered')
+    })
+
     it('should keep a response that is still being received', function () {
       /* room for exactly one ADU, so the incomplete frame sits right at the limit */
       handler = new TCPResponseHandler(11)
@@ -313,5 +340,50 @@ describe('Modbus/TCP Client Response Handler Tests', function () {
       assert.equal(1, response.id)
       assert.equal(1, response.body.fc)
     })
+
+    /* The cases above pin individual scenarios, but the property that actually matters is a
+     * global one: wherever the stream is cut and whatever lands between frames, a response that
+     * reaches the caller must be the one the device sent. The seed is fixed so a failure is
+     * reproducible.
+     */
+    it('should never deliver a corrupted response under random noise', function () {
+      let seed = 0x2f6e2b1
+      const rnd = function (n) { seed = (seed * 1103515245 + 12345) & 0x7fffffff; return seed % n }
+
+      handler = new TCPResponseHandler()
+
+      let delivered = 0
+
+      for (let round = 0; round < 2000; round += 1) {
+        if (rnd(3) === 0) {
+          const noise = Buffer.alloc(1 + rnd(12))
+          for (let i = 0; i < noise.length; i += 1) { noise[i] = rnd(256) }
+          handler.handleData(noise)
+        }
+
+        const frame = readCoilsResponse()
+
+        if (rnd(2) === 0) {
+          const at = 1 + rnd(frame.length - 1)
+          handler.handleData(frame.slice(0, at))
+          handler.handleData(frame.slice(at))
+        } else {
+          handler.handleData(frame)
+        }
+
+        let response
+        while ((response = handler.shift()) !== undefined) {
+          delivered += 1
+          assert.equal(1, response.body.fc, 'a response built from noise reached the caller')
+          assert.deepEqual(
+            [1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0],
+            response.body.valuesAsArray,
+            'a response built from noise reached the caller'
+          )
+        }
+      }
+
+      assert.ok(delivered > 1500, `expected the handler to keep recovering, got ${delivered}`)
+    })
   })
 })

From 0db52fc828e31bed5b04aebc3b5403e3f22df209 Mon Sep 17 00:00:00 2001
From: Barneey96 <barnabas.ajtay@proton.me>
Date: Tue, 29 Sep 2026 12:01:47 +0200
Subject: [PATCH 5/7] revert: drop receive buffer resynchronization changes

Reverts 6a1fb68, 375f2c4, 686c522 and 7590c5a to bring the branch back
to the state of v5.0-dev. The faulty-response handling will instead be
made pluggable via custom per function code response handlers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 package-lock.json                        |   4 +-
 package.json                             |   2 +-
 src/client-response-handler.ts           |  40 +----
 src/constants/limits.ts                  |  26 ---
 src/modbus-rtu-client.ts                 |  11 +-
 src/modbus-tcp-client.ts                 |  12 +-
 src/rtu-client-response-handler.ts       |  62 +------
 src/rtu-response.ts                      |  46 +-----
 src/tcp-client-response-handler.ts       |  59 +------
 src/tcp-response.ts                      |  22 ---
 test/rtu-client-response-handler.test.js | 195 +---------------------
 test/tcp-response-handler.test.js        | 202 -----------------------
 12 files changed, 26 insertions(+), 655 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 6d8f388..3beabd3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "jsmodbus",
-  "version": "5.0.1",
+  "version": "5.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "jsmodbus",
-      "version": "5.0.1",
+      "version": "5.0.0",
       "license": "MIT",
       "dependencies": {
         "commander": "^11.1.0",
diff --git a/package.json b/package.json
index 5e93f4f..a992265 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jsmodbus",
-  "version": "5.0.1",
+  "version": "5.0.0",
   "description": "Implementation for the Serial/TCP Modbus protocol.",
   "author": "Stefan Poeter <stefan.poeter@cloud-automation.de>",
   "main": "./dist/modbus.js",
diff --git a/src/client-response-handler.ts b/src/client-response-handler.ts
index 0a6ebf1..1225cb4 100644
--- a/src/client-response-handler.ts
+++ b/src/client-response-handler.ts
@@ -1,5 +1,4 @@
 import MBAbstractResponse from './abstract-response'
-import { LIMITS } from './constants'
 
 /** Modbus Client Repsonse Handler
  * @abstract
@@ -7,23 +6,10 @@ import { LIMITS } from './constants'
 export default abstract class ModbusClientResponseHandler<ResType extends MBAbstractResponse = MBAbstractResponse> {
   protected _buffer: Buffer
   protected abstract _messages: ResType[]
-  protected readonly _maxBufferSize: number
 
-  /** Create new Modbus Client Response Handler
-   * @param {number} [maxBufferSize=LIMITS.TCP_ADU_MAX] The number of bytes the receive buffer may
-   *   hold without a single complete response being parsable from it. Defaults to the largest
-   *   Modbus/TCP ADU.
-   */
-  constructor (maxBufferSize: number = LIMITS.TCP_ADU_MAX) {
+  /** Create new Modbus Client Response Handler */
+  constructor () {
     this._buffer = Buffer.alloc(0)
-    this._maxBufferSize = maxBufferSize
-  }
-
-  /** The number of bytes the receive buffer may hold without a single complete response
-   * being parsable from it.
-   */
-  public get maxBufferSize () {
-    return this._maxBufferSize
   }
 
   /** Process new incoming data and enqueue new modbus responses.
@@ -37,26 +23,4 @@ export default abstract class ModbusClientResponseHandler<ResType extends MBAbst
   public shift () {
     return this._messages.shift()
   }
-
-  /** Discard the receive buffer if it cannot hold the beginning of a valid frame anymore.
-   *
-   * The buffer only ever advances when a complete response parses, and every frame is read
-   * from offset 0. A frame that never completes - a device answering with fewer bytes than
-   * its header announces, a truncated frame, line noise - therefore stays in front of every
-   * following response forever, and the client keeps timing out until the socket is
-   * reconnected.
-   *
-   * Whatever is dropped may contain the beginning of an intact response, in which case the
-   * remainder of that response desyncs the buffer again and is discarded the same way. The
-   * resynchronization therefore is not immediate, but it always converges.
-   *
-   * Call this only once no further response can be parsed from the buffer.
-   */
-  protected _discardOversizedBuffer () {
-    if (this._buffer.length <= this._maxBufferSize) {
-      return
-    }
-
-    this._buffer = Buffer.alloc(0)
-  }
 }
diff --git a/src/constants/limits.ts b/src/constants/limits.ts
index e0565cb..540f047 100644
--- a/src/constants/limits.ts
+++ b/src/constants/limits.ts
@@ -8,38 +8,12 @@ const COIL_MAX = 0x01
 
 const ERROR_CODE_THRESHOLD = 0x80
 
-/* The size of the Modbus PDU is limited to 253 bytes. The constraint comes from the
- * first Modbus implementation on serial line, where the maximum RTU ADU is 256 bytes:
- * 256 - 1 byte server address - 2 bytes CRC = 253. See Modbus Application Protocol V1.1b3, section 4.1
- */
-const PDU_MAX = 253
-
-/* Address (1) + PDU (253) + CRC (2) */
-const RTU_ADU_MAX = 256
-
-/* MBAP header (7) + PDU (253) */
-const TCP_ADU_MAX = 260
-
-/* Transaction id (2) + protocol id (2) + length (2). The length field that follows counts the
- * unit identifier and the PDU, so a complete Modbus/TCP ADU is MBAP_PREFIX_LENGTH + length and
- * the length field itself can never leave 2 .. PDU_MAX + 1.
- */
-const MBAP_PREFIX_LENGTH = 6
-
-/* The protocol identifier reserved for Modbus in the MBAP header */
-const MBAP_PROTOCOL_ID = 0x0000
-
 export const LIMITS = {
   COIL_MAX,
   COIL_MIN,
   ERROR_CODE_THRESHOLD,
-  MBAP_PREFIX_LENGTH,
-  MBAP_PROTOCOL_ID,
-  PDU_MAX,
   REGISTER_MAX,
   REGISTER_MIN,
-  RTU_ADU_MAX,
-  TCP_ADU_MAX,
   UINT16_MAX,
   UINT16_MIN
 } as const
diff --git a/src/modbus-rtu-client.ts b/src/modbus-rtu-client.ts
index 91000a1..3bb51b4 100644
--- a/src/modbus-rtu-client.ts
+++ b/src/modbus-rtu-client.ts
@@ -1,5 +1,4 @@
 
-import { LIMITS } from './constants'
 import MBClient from './modbus-client.js'
 import ModbusRTUClientRequestHandler from './rtu-client-request-handler.js'
 import ModbusRTUClientResponseHandler from './rtu-client-response-handler.js'
@@ -28,18 +27,12 @@ export default class ModbusRTUClient extends MBClient<SerialPort, ModbusRTUReque
    * @param {SerialPort} socket The serial Socket.
    * @param {number} address The address of the serial client.
    * @param {number} [timeout=5000]
-   * @param {number} [maxBufferSize=LIMITS.RTU_ADU_MAX] The number of bytes the receive buffer may hold
    */
-  constructor (
-    socket: SerialPort,
-    address: number,
-    timeout = 5000,
-    maxBufferSize: number = LIMITS.RTU_ADU_MAX
-  ) {
+  constructor (socket: SerialPort, address: number, timeout = 5000) {
     super(socket)
 
     this._requestHandler = new ModbusRTUClientRequestHandler(socket, address, timeout)
-    this._responseHandler = new ModbusRTUClientResponseHandler(maxBufferSize)
+    this._responseHandler = new ModbusRTUClientResponseHandler()
   }
 
   public get slaveId () {
diff --git a/src/modbus-tcp-client.ts b/src/modbus-tcp-client.ts
index 5b88ffa..f593b1b 100644
--- a/src/modbus-tcp-client.ts
+++ b/src/modbus-tcp-client.ts
@@ -1,10 +1,10 @@
 
 import { Socket } from 'net'
-import { LIMITS } from './constants'
 import MBClient from './modbus-client.js'
 import MBTCPClientRequestHandler from './tcp-client-request-handler.js'
 import ModbusTCPClientResponseHandler from './tcp-client-response-handler.js'
 import ModbusTCPRequest from './tcp-request.js'
+import ModbusTCPResponse from './tcp-response.js'
 
 /** This client must be initiated with a net.Socket object. The module does not handle reconnections
  * or anything related to keep the connection up in case of an unplugged cable or a closed server. See
@@ -36,19 +36,13 @@ export default class ModbusTCPClient extends MBClient<Socket, ModbusTCPRequest>
    * @param {Socket} socket The TCP Socket.
    * @param {number} [unitId=1] Unit ID
    * @param {number} [timeout=5000] Timeout for requests in ms.
-   * @param {number} [maxBufferSize=LIMITS.TCP_ADU_MAX] The number of bytes the receive buffer may hold
    * @memberof ModbusTCPClient
    */
-  constructor (
-    socket: Socket,
-    unitId: number = 1,
-    timeout: number = 5000,
-    maxBufferSize: number = LIMITS.TCP_ADU_MAX
-  ) {
+  constructor (socket: Socket, unitId: number = 1, timeout: number = 5000) {
     super(socket)
 
     this._requestHandler = new MBTCPClientRequestHandler(socket, unitId, timeout)
-    this._responseHandler = new ModbusTCPClientResponseHandler(maxBufferSize)
+    this._responseHandler = new ModbusTCPClientResponseHandler()
 
     this._unitId = unitId
     this._timeout = timeout
diff --git a/src/rtu-client-response-handler.ts b/src/rtu-client-response-handler.ts
index 2640dc0..71fade0 100644
--- a/src/rtu-client-response-handler.ts
+++ b/src/rtu-client-response-handler.ts
@@ -1,7 +1,5 @@
-import Debug from 'debug'; const debug = Debug('rtu-response-handler')
+import Debug = require('debug'); const debug = Debug('rtu-response-handler')
 import ModbusClientResponseHandler from './client-response-handler.js'
-import { isFunctionCode } from './codes'
-import { LIMITS } from './constants'
 import ModbusRTUResponse from './rtu-response.js'
 
 /** Modbus/RTU Client Response Handler
@@ -11,12 +9,8 @@ import ModbusRTUResponse from './rtu-response.js'
 export default class ModbusRTUClientResponseHandler extends ModbusClientResponseHandler<ModbusRTUResponse> {
   protected _messages: ModbusRTUResponse[]
 
-  /** Create new Modbus/RTU Client Response Handler
-   * @param {number} [maxBufferSize=LIMITS.RTU_ADU_MAX] The number of bytes the receive buffer may
-   *   hold without a single complete response being parsable from it.
-   */
-  constructor (maxBufferSize: number = LIMITS.RTU_ADU_MAX) {
-    super(maxBufferSize)
+  constructor () {
+    super()
     this._messages = []
   }
 
@@ -30,29 +24,10 @@ export default class ModbusRTUClientResponseHandler extends ModbusClientResponse
       const response = ModbusRTUResponse.fromBuffer(this._buffer)
 
       if (!response) {
-        if (this._resynchronize()) {
-          continue
-        }
-
         debug('not enough data available to parse')
-        /* the remaining bytes are at most one incomplete frame by now, so anything beyond
-         * the largest possible ADU cannot be waiting for more data to arrive
-         */
-        this._discardOversizedBuffer()
         return
       }
 
-      if (response.corrupted) {
-        /* The CRC covers the whole frame, so a mismatch proves offset 0 is not where this
-         * response starts. Drop a single byte rather than the frame the parser believed it
-         * saw: its byte count was derived from bytes we just proved untrustworthy, so
-         * skipping it could swallow the real frame that begins in the middle of it.
-         */
-        debug('crc mismatch, skipping one byte to resynchronize')
-        this._buffer = this._buffer.slice(1)
-        continue
-      }
-
       debug('crc', response.crc)
 
       debug('reset buffer from', this._buffer.length, 'to', (this._buffer.length - response.byteCount))
@@ -67,35 +42,4 @@ export default class ModbusRTUClientResponseHandler extends ModbusClientResponse
   public shift () {
     return this._messages.shift()
   }
-
-  /** Drop the leading byte when it provably cannot begin a response, and report whether it did.
-   *
-   * A frame that failed to parse is usually just still arriving, so the buffer has to be left
-   * alone. The one thing that can be decided from an incomplete frame is its function code: the
-   * parser accepts a body only for a known function code, or for an exception whose underlying
-   * code is known, so anything else can never parse no matter how many bytes follow it. Waiting
-   * for the buffer to outgrow an ADU before dropping it would stall every request in the
-   * meantime, and each stalled request costs a full timeout.
-   *
-   * Only ever one byte: the real frame may start anywhere inside what is being skipped.
-   */
-  private _resynchronize () {
-    if (this._buffer.length < 2) {
-      /* the function code has not arrived yet */
-      return false
-    }
-
-    const fc = this._buffer.readUInt8(1)
-    const isException = fc > LIMITS.ERROR_CODE_THRESHOLD &&
-      isFunctionCode(fc - LIMITS.ERROR_CODE_THRESHOLD)
-
-    if (isFunctionCode(fc) || isException) {
-      return false
-    }
-
-    debug('function code', fc, 'cannot start a response, skipping one byte to resynchronize')
-    this._buffer = this._buffer.slice(1)
-
-    return true
-  }
 }
diff --git a/src/rtu-response.ts b/src/rtu-response.ts
index 3176368..c903738 100644
--- a/src/rtu-response.ts
+++ b/src/rtu-response.ts
@@ -17,14 +17,6 @@ export default class ModbusRTUResponse<ResBody extends ModbusResponseBody = Modb
     return this._crc
   }
 
-  /** True when the frame's CRC does not match its payload, which means these bytes are not a
-   * trustworthy response - either the buffer lost its frame alignment or the line corrupted
-   * the message. Mirrors ModbusRTURequest#corrupted.
-   */
-  get corrupted () {
-    return this._corrupted
-  }
-
   get body () {
     return this._body
   }
@@ -58,7 +50,7 @@ export default class ModbusRTUResponse<ResBody extends ModbusResponseBody = Modb
   }
 
   public static fromBuffer (buffer: Buffer) {
-    if (buffer.length < 1 /* address */ + 2 /* CRC */) {
+    if (buffer.length < 1) {
       return null
     }
 
@@ -72,53 +64,25 @@ export default class ModbusRTUResponse<ResBody extends ModbusResponseBody = Modb
       return null
     }
 
-    const payloadLength = 1 /* address */ + body.byteCount
-
-    let actualCrc
+    let crc
     try {
-      actualCrc = buffer.readUInt16LE(payloadLength)
+      crc = buffer.readUInt16LE(1 + body.byteCount)
     } catch (e) {
       debug('If NoSuchIndexException, it is probably serial and not all data has arrived')
       return null
     }
 
-    /* Modbus/RTU carries no framing in the payload, so the CRC is the only evidence that the
-     * bytes really start a response here: a buffer that lost its alignment otherwise parses
-     * into a structurally valid but fabricated response - a stray leading byte turns a read
-     * holding registers answer into a read coils answer with invented values.
-     *
-     * ModbusRTUClientRequestHandler verifies the crc again and rejects such a response, so it
-     * never reaches the application, but by then these bytes have already been consumed and the
-     * stream stays out of step - the request is lost rather than recovered. Reporting the
-     * mismatch here instead lets the response handler step over the stray byte and go on to
-     * find the real frame.
-     */
-    const expectedCrc = CRC.crc16modbus(buffer.slice(0, payloadLength))
-    const corrupted = (expectedCrc !== actualCrc)
-
-    if (corrupted) {
-      debug('crc mismatch, expected', expectedCrc, 'got', actualCrc)
-    }
-
-    return new ModbusRTUResponse(address, actualCrc, body, corrupted)
+    return new ModbusRTUResponse(address, crc, body)
   }
   public _address: number
   public _crc: number | undefined
   protected _body: ResBody
-  protected _corrupted: boolean
 
-  /** Create new Modbus/RTU Response Object.
-   * @param {number} address Address/Unit ID
-   * @param {number} [crc] CRC of the frame, undefined until createPayload () calculates it
-   * @param {ModbusResponseBody} body Modbus response body object
-   * @param {boolean} [corrupted=false] Whether the frame's CRC failed to verify
-   */
-  constructor (address: number, crc: number | undefined, body: ResBody, corrupted: boolean = false) {
+  constructor (address: number, crc: number | undefined, body: ResBody) {
     super()
     this._address = address
     this._crc = crc
     this._body = body
-    this._corrupted = corrupted
   }
 
   public createPayload () {
diff --git a/src/tcp-client-response-handler.ts b/src/tcp-client-response-handler.ts
index e190465..a499870 100644
--- a/src/tcp-client-response-handler.ts
+++ b/src/tcp-client-response-handler.ts
@@ -1,6 +1,5 @@
 import Debug = require('debug'); const debug = Debug('tcp-response-handler')
 import ModbusClientResponseHandler from './client-response-handler.js'
-import { LIMITS } from './constants'
 import ModbusTCPResponse from './tcp-response.js'
 
 /** Modbus/TCP Client Response Handler.
@@ -10,12 +9,10 @@ import ModbusTCPResponse from './tcp-response.js'
 export default class ModbusTCPClientResponseHandler extends ModbusClientResponseHandler<ModbusTCPResponse> {
   protected _messages: ModbusTCPResponse[]
 
-  /** Create new Modbus/TCP Client Response Handler
-   * @param {number} [maxBufferSize=LIMITS.TCP_ADU_MAX] The number of bytes the receive buffer may
-   *   hold without a single complete response being parsable from it.
-   */
-  constructor (maxBufferSize: number = LIMITS.TCP_ADU_MAX) {
-    super(maxBufferSize)
+  /** Create new Modbus/TCP Client Response Handler */
+  constructor () {
+    super()
+    this._buffer = Buffer.alloc(0)
     this._messages = []
   }
 
@@ -29,15 +26,7 @@ export default class ModbusTCPClientResponseHandler extends ModbusClientResponse
       const response = ModbusTCPResponse.fromBuffer(this._buffer)
 
       if (!response) {
-        if (this._resynchronize()) {
-          continue
-        }
-
         debug('not enough data available to parse')
-        /* nothing could be skipped, so the bytes left are one frame that is still arriving;
-         * anything beyond the largest possible ADU cannot be waiting for more data
-         */
-        this._discardOversizedBuffer()
         return
       }
 
@@ -56,44 +45,4 @@ export default class ModbusTCPClientResponseHandler extends ModbusClientResponse
       this._buffer = this._buffer.slice(response.byteCount)
     } while (1)
   }
-
-  /** Move the buffer to the next plausible frame after a response failed to parse and report
-   * whether anything was skipped.
-   *
-   * Unlike a raw serial stream, Modbus/TCP prefixes every frame with an MBAP header stating the
-   * exact frame length, so a desynchronized buffer can normally be realigned in a single step
-   * rather than by waiting for it to outgrow an ADU. A frame that has fully arrived and still
-   * does not parse - an unimplemented function code, a corrupt payload - is skipped whole,
-   * because its header told us exactly where the next one begins.
-   *
-   * Bytes that cannot be an MBAP header at all cost a single byte each instead: the real frame
-   * may begin anywhere inside them, so skipping further could swallow it.
-   */
-  private _resynchronize () {
-    if (this._buffer.length < LIMITS.MBAP_PREFIX_LENGTH) {
-      /* the header itself is still arriving */
-      return false
-    }
-
-    const protocol = this._buffer.readUInt16BE(2)
-    const length = this._buffer.readUInt16BE(4)
-
-    if (protocol !== LIMITS.MBAP_PROTOCOL_ID || length < 2 || length > LIMITS.PDU_MAX + 1) {
-      debug('implausible mbap header, skipping one byte to resynchronize')
-      this._buffer = this._buffer.slice(1)
-      return true
-    }
-
-    const frameLength = LIMITS.MBAP_PREFIX_LENGTH + length
-
-    if (this._buffer.length < frameLength) {
-      /* the announced frame is still on its way */
-      return false
-    }
-
-    debug('skipping a complete but unparsable frame of', frameLength, 'bytes')
-    this._buffer = this._buffer.slice(frameLength)
-
-    return true
-  }
 }
diff --git a/src/tcp-response.ts b/src/tcp-response.ts
index 106f556..8fbb8c1 100644
--- a/src/tcp-response.ts
+++ b/src/tcp-response.ts
@@ -1,6 +1,5 @@
 import Debug = require('debug'); const debug = Debug('tcp-response')
 import ModbusAbstractResponse from './abstract-response.js'
-import { LIMITS } from './constants'
 import { ModbusRequestBody } from './request'
 import ModbusResponseBody from './response/response-body.js'
 import ResponseFactory from './response/response-factory.js'
@@ -76,17 +75,6 @@ export default class ModbusTCPResponse<ResBody extends ModbusResponseBody = Modb
       const id = buffer.readUInt16BE(0)
       const protocol = buffer.readUInt16BE(2)
       const length = buffer.readUInt16BE(4)
-
-      /* The length field states exactly how many bytes follow it, and Buffer#slice silently
-       * clamps to the end of the buffer. Without this guard a device that answers with fewer
-       * bytes than it announced yields a response parsed from data that never arrived, whose
-       * byteCount then advances the receive buffer past its own end.
-       */
-      if (buffer.length < LIMITS.MBAP_PREFIX_LENGTH + length) {
-        debug('the announced frame has not arrived completely yet')
-        return null
-      }
-
       const unitId = buffer.readUInt8(6)
 
       debug('tcp header complete, id', id, 'protocol', protocol, 'length', length, 'unitId', unitId)
@@ -99,16 +87,6 @@ export default class ModbusTCPResponse<ResBody extends ModbusResponseBody = Modb
         return null
       }
 
-      /* The length field counts the unit identifier plus the PDU, so the body has to consume
-       * the announced payload exactly. A body that stops short means these bytes are not the
-       * frame the header described - most often noise that happened to look like an MBAP
-       * header, which would otherwise be handed on as a short but structurally valid response.
-       */
-      if (body.byteCount !== length - 1) {
-        debug('body of', body.byteCount, 'bytes does not fill the announced', length - 1)
-        return null
-      }
-
       debug('buffer contains a valid response body')
 
       return new ModbusTCPResponse(id, protocol, length, unitId, body)
diff --git a/test/rtu-client-response-handler.test.js b/test/rtu-client-response-handler.test.js
index f926826..2586cd7 100644
--- a/test/rtu-client-response-handler.test.js
+++ b/test/rtu-client-response-handler.test.js
@@ -20,7 +20,7 @@ describe('Modbus/RTU Client Response Tests', function () {
       0x02,       // byte count
       0xdd,       // coils
       0x00,
-      0xE0, 0xAC // crc
+      0xCD, 0xAB // crc
     ])
 
     handler.handleData(responseBuffer)
@@ -30,8 +30,7 @@ describe('Modbus/RTU Client Response Tests', function () {
     assert.ok(response !== null)
     assert.equal(1, response.address)
     assert.equal(1, response.body.fc)
-    assert.equal(0xACE0, response.crc)
-    assert.equal(false, response.corrupted)
+    assert.equal(0xABCD, response.crc)
     assert.equal(7, response.byteCount)
 
     assert.equal(1, response.body.fc)
@@ -42,7 +41,7 @@ describe('Modbus/RTU Client Response Tests', function () {
       0x01,       // address
       0x81,       // exception code for fc 0x01
       0x01,       // exception code ILLEGAL FUNCTION
-      0x81, 0x90  // crc
+      0x00, 0x00  // crc
     ])
 
     handler.handleData(responseBuffer)
@@ -64,7 +63,7 @@ describe('Modbus/RTU Client Response Tests', function () {
       0x02,       // byte count
       0xdd,       // coils
       0x00,
-      0xE0, 0xAC  // crc
+      0x00, 0x00  // crc
     ])
 
     handler.handleData(responseBufferA)
@@ -82,190 +81,4 @@ describe('Modbus/RTU Client Response Tests', function () {
     assert.equal(1, response.body.fc)
     assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
   })
-
-  /* Modbus/RTU carries no framing in the payload, so line noise or a frame the device never
-   * completed stays in front of every following response: the buffer only ever advances when a
-   * complete response parses and every frame is read from offset 0. The CRC is the only
-   * evidence that a frame really starts where the parser is looking.
-   */
-  describe('resynchronizing an unparsable buffer', function () {
-    /* Address, function code 0x03 and a byte count of 250: a perfectly plausible start that the
-     * device never finished. The function code is real, so nothing but the buffer limit can
-     * prove these bytes will never become a frame.
-     */
-    const stalledFrame = Buffer.from([0x01, 0x03, 0xfa])
-
-    const readCoilsResponse = function () {
-      return Buffer.from([
-        0x01,       // address
-        0x01,       // function code
-        0x02,       // byte count
-        0xdd,       // coils
-        0x00,
-        0xE0, 0xAC  // crc
-      ])
-    }
-
-    /* 2 registers, 0x000A and 0x0014 */
-    const readHoldingRegistersResponse = function () {
-      return Buffer.from([
-        0x01,       // address
-        0x03,       // function code
-        0x04,       // byte count
-        0x00, 0x0A, // register 0
-        0x00, 0x14, // register 1
-        0xDA, 0x3E  // crc
-      ])
-    }
-
-    it('should default to the largest possible Modbus/RTU ADU', function () {
-      assert.equal(256, new ModbusRTUClientResponseHandler().maxBufferSize)
-      assert.equal(64, new ModbusRTUClientResponseHandler(64).maxBufferSize)
-    })
-
-    /* Without the CRC check a single stray byte turns this read holding registers answer into a
-     * read coils answer with invented values. The client rejects that further up, so no wrong
-     * reading ever reaches the application, but only after these bytes were consumed - the
-     * request is lost instead of recovered. Verifying the crc here lets the handler step over
-     * the stray byte and return the answer the device actually sent.
-     */
-    it('should not deliver a misaligned frame as a valid response', function () {
-      handler.handleData(Buffer.concat([
-        Buffer.from([0x01]), // a stray byte in front of an otherwise intact frame
-        readHoldingRegistersResponse()
-      ]))
-
-      const response = handler.shift()
-
-      assert.ok(response !== undefined, 'the handler did not resynchronize')
-      assert.equal(3, response.body.fc, 'the misaligned read coils parse must not be delivered')
-      assert.equal(1, response.address)
-      assert.deepEqual([10, 20], response.body.valuesAsArray)
-      assert.equal(undefined, handler.shift(), 'only one response may be delivered')
-    })
-
-    it('should resynchronize within the same chunk the stray bytes arrive in', function () {
-      handler.handleData(Buffer.concat([
-        Buffer.from([0xff, 0xff]),
-        readCoilsResponse()
-      ]))
-
-      const response = handler.shift()
-
-      assert.ok(response !== undefined, 'the frame after the noise must still be found')
-      assert.equal(1, response.body.fc)
-      assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
-    })
-
-    it('should drop a frame whose crc does not verify', function () {
-      const corrupt = readCoilsResponse()
-      corrupt[3] = 0xab // flip a coil byte, leaving the crc stale
-
-      handler.handleData(corrupt)
-
-      assert.equal(undefined, handler.shift(), 'a crc failure must never reach the caller')
-    })
-
-    /* A frame that stalled behind a valid function code carries no crc to check yet and no
-     * length to measure, so Modbus/RTU still needs the buffer limit as its backstop.
-     */
-    it('should discard the buffer when no response parses from more than maxBufferSize bytes', function () {
-      handler = new ModbusRTUClientResponseHandler(12)
-
-      handler.handleData(stalledFrame)
-      assert.equal(undefined, handler.shift(), 'an unfinished frame must not parse')
-
-      /* 10 bytes, below the limit, the stalled frame keeps this response from parsing */
-      handler.handleData(readCoilsResponse())
-      assert.equal(undefined, handler.shift(), 'the stalled frame must desync this response')
-
-      /* 17 bytes, beyond the limit, the prefix provably is not the start of a frame */
-      handler.handleData(readCoilsResponse())
-      assert.equal(undefined, handler.shift())
-
-      /* the buffer was dropped, so this response is aligned again */
-      handler.handleData(readCoilsResponse())
-
-      const response = handler.shift()
-
-      assert.ok(response !== undefined, 'the handler did not resynchronize')
-      assert.equal(1, response.address)
-      assert.equal(1, response.body.fc)
-      assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
-    })
-
-    it('should keep a response that is still being received', function () {
-      /* room for exactly one ADU, so the incomplete frame sits right at the limit */
-      handler = new ModbusRTUClientResponseHandler(7)
-      const responseBuffer = readCoilsResponse()
-
-      handler.handleData(responseBuffer.slice(0, 4))
-      assert.equal(undefined, handler.shift())
-
-      handler.handleData(responseBuffer.slice(4))
-
-      const response = handler.shift()
-
-      assert.ok(response !== undefined, 'a frame at the limit must not be discarded')
-      assert.equal(1, response.body.fc)
-    })
-
-    it('should resynchronize with the default limit as well', function () {
-      handler.handleData(stalledFrame)
-
-      let response
-      for (let i = 0; i < 45 && response === undefined; i += 1) {
-        handler.handleData(readCoilsResponse())
-        response = handler.shift()
-      }
-
-      assert.ok(response !== undefined, 'the handler never resynchronized')
-      assert.equal(1, response.body.fc)
-    })
-
-    /* The cases above pin individual scenarios, but the property that actually matters is a
-     * global one: wherever the stream is cut and whatever lands between frames, a response that
-     * reaches the caller must be the one the device sent. The seed is fixed so a failure is
-     * reproducible.
-     */
-    it('should never deliver a corrupted response under random noise', function () {
-      let seed = 0x2f6e2b1
-      const rnd = function (n) { seed = (seed * 1103515245 + 12345) & 0x7fffffff; return seed % n }
-
-      handler = new ModbusRTUClientResponseHandler()
-
-      let delivered = 0
-
-      for (let round = 0; round < 2000; round += 1) {
-        if (rnd(3) === 0) {
-          const noise = Buffer.alloc(1 + rnd(12))
-          for (let i = 0; i < noise.length; i += 1) { noise[i] = rnd(256) }
-          handler.handleData(noise)
-        }
-
-        const frame = readCoilsResponse()
-
-        if (rnd(2) === 0) {
-          const at = 1 + rnd(frame.length - 1)
-          handler.handleData(frame.slice(0, at))
-          handler.handleData(frame.slice(at))
-        } else {
-          handler.handleData(frame)
-        }
-
-        let response
-        while ((response = handler.shift()) !== undefined) {
-          delivered += 1
-          assert.equal(1, response.body.fc, 'a response built from noise reached the caller')
-          assert.deepEqual(
-            [1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0],
-            response.body.valuesAsArray,
-            'a response built from noise reached the caller'
-          )
-        }
-      }
-
-      assert.ok(delivered > 1500, `expected the handler to keep recovering, got ${delivered}`)
-    })
-  })
 })
diff --git a/test/tcp-response-handler.test.js b/test/tcp-response-handler.test.js
index aa27894..df832fb 100644
--- a/test/tcp-response-handler.test.js
+++ b/test/tcp-response-handler.test.js
@@ -184,206 +184,4 @@ describe('Modbus/TCP Client Response Handler Tests', function () {
     assert.equal(1, response.body.fc)
     assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
   })
-
-  /* A device that answers with fewer bytes than its MBAP header announces, or with a frame this
-   * library has no parser for, leaves a prefix in the receive buffer. The buffer only ever
-   * advances when a complete response parses and every frame is read from offset 0, so that
-   * prefix desyncs every following response until the handler realigns itself. Unlike a serial
-   * stream, Modbus/TCP states the frame length in its header, so realigning rarely costs more
-   * than the damaged frame itself.
-   */
-  describe('resynchronizing an unparsable buffer', function () {
-    /* the beginning of a response the device never completed */
-    const truncatedFrame = Buffer.from([0x00, 0x2a, 0x00, 0x00])
-
-    const readCoilsResponse = function () {
-      return Buffer.from([
-        0x00, 0x01, // transaction id
-        0x00, 0x00, // protocol
-        0x00, 0x05, // length
-        0x03,       // unit id
-        0x01,       // function code
-        0x02,       // byte count
-        0xdd,       // coils
-        0x00
-      ])
-    }
-
-    /* A complete, well formed frame carrying function code 0x11 (Report Server ID), which this
-     * library has no response parser for. Its header still says exactly where it ends.
-     */
-    const unsupportedFunctionResponse = function () {
-      return Buffer.from([
-        0x00, 0x07, // transaction id
-        0x00, 0x00, // protocol
-        0x00, 0x04, // length
-        0x03,       // unit id
-        0x11,       // function code
-        0x02,       // byte count
-        0xaa
-      ])
-    }
-
-    it('should default to the largest possible Modbus/TCP ADU', function () {
-      assert.equal(260, new TCPResponseHandler().maxBufferSize)
-      assert.equal(64, new TCPResponseHandler(64).maxBufferSize)
-    })
-
-    it('should skip a complete but unparsable frame in a single step', function () {
-      handler.handleData(Buffer.concat([
-        unsupportedFunctionResponse(),
-        readCoilsResponse()
-      ]))
-
-      const response = handler.shift()
-
-      assert.ok(response !== undefined, 'the frame behind the unparsable one must be found')
-      assert.equal(1, response.id)
-      assert.equal(1, response.body.fc)
-      assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
-    })
-
-    it('should resynchronize as soon as the next response arrives', function () {
-      handler.handleData(truncatedFrame)
-      assert.equal(undefined, handler.shift(), 'a truncated frame must not parse')
-
-      handler.handleData(readCoilsResponse())
-
-      const response = handler.shift()
-
-      assert.ok(response !== undefined, 'the handler did not resynchronize')
-      assert.equal(1, response.id)
-      assert.equal(1, response.body.fc)
-      assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
-    })
-
-    /* Buffer#slice clamps silently, so without the length guard this parses into a response
-     * built from bytes that never arrived.
-     */
-    it('should not parse a frame that announced more bytes than it sent', function () {
-      const lying = readCoilsResponse()
-      lying.writeUInt16BE(0x20, 4) // claim 32 bytes follow, then send 5
-
-      handler.handleData(lying)
-
-      assert.equal(undefined, handler.shift(), 'an incomplete frame must never reach the caller')
-    })
-
-    /* The frame has fully arrived, but the body stops short of the length the header announced,
-     * which is how noise that happens to look like an MBAP header presents itself.
-     */
-    it('should not parse a frame whose body does not fill the announced length', function () {
-      handler.handleData(Buffer.concat([
-        Buffer.from([
-          0x00, 0x01, // transaction id
-          0x00, 0x00, // protocol
-          0x00, 0x08, // length: claims a 7 byte pdu
-          0x03,       // unit id
-          0x01,       // function code
-          0x02,       // byte count
-          0xdd,       // coils
-          0x00,
-          0x00, 0x00, 0x00 // padding the body never accounts for
-        ]),
-        readCoilsResponse()
-      ]))
-
-      const response = handler.shift()
-
-      assert.ok(response !== undefined, 'the frame behind the bad one must still be found')
-      assert.equal(1, response.id, 'the short body must not be delivered')
-      assert.deepEqual([1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0], response.body.valuesAsArray)
-      assert.equal(undefined, handler.shift(), 'only one response may be delivered')
-    })
-
-    it('should keep a response that is still being received', function () {
-      /* room for exactly one ADU, so the incomplete frame sits right at the limit */
-      handler = new TCPResponseHandler(11)
-      const responseBuffer = readCoilsResponse()
-
-      handler.handleData(responseBuffer.slice(0, 6))
-      assert.equal(undefined, handler.shift())
-
-      handler.handleData(responseBuffer.slice(6))
-
-      const response = handler.shift()
-
-      assert.ok(response !== undefined, 'a frame at the limit must not be discarded')
-      assert.equal(1, response.body.fc)
-    })
-
-    /* A header that is plausible and announces a frame still on its way cannot be skipped - the
-     * rest may genuinely be in flight - so the buffer limit remains the backstop for a device
-     * that stops halfway through a frame it announced.
-     */
-    it('should discard the buffer when no response parses from more than maxBufferSize bytes', function () {
-      handler = new TCPResponseHandler(20)
-
-      /* announces 100 bytes and then stops */
-      handler.handleData(Buffer.from([0x00, 0x2a, 0x00, 0x00, 0x00, 0x64, 0x03]))
-      assert.equal(undefined, handler.shift(), 'a stalled frame must not parse')
-
-      /* 18 bytes, below the limit, the stalled frame keeps this response from parsing */
-      handler.handleData(readCoilsResponse())
-      assert.equal(undefined, handler.shift(), 'the stalled frame must desync this response')
-
-      /* 29 bytes, beyond the limit, so the buffer is dropped */
-      handler.handleData(readCoilsResponse())
-      assert.equal(undefined, handler.shift())
-
-      /* the buffer was dropped, so this response is aligned again */
-      handler.handleData(readCoilsResponse())
-
-      const response = handler.shift()
-
-      assert.ok(response !== undefined, 'the handler did not resynchronize')
-      assert.equal(1, response.id)
-      assert.equal(1, response.body.fc)
-    })
-
-    /* The cases above pin individual scenarios, but the property that actually matters is a
-     * global one: wherever the stream is cut and whatever lands between frames, a response that
-     * reaches the caller must be the one the device sent. The seed is fixed so a failure is
-     * reproducible.
-     */
-    it('should never deliver a corrupted response under random noise', function () {
-      let seed = 0x2f6e2b1
-      const rnd = function (n) { seed = (seed * 1103515245 + 12345) & 0x7fffffff; return seed % n }
-
-      handler = new TCPResponseHandler()
-
-      let delivered = 0
-
-      for (let round = 0; round < 2000; round += 1) {
-        if (rnd(3) === 0) {
-          const noise = Buffer.alloc(1 + rnd(12))
-          for (let i = 0; i < noise.length; i += 1) { noise[i] = rnd(256) }
-          handler.handleData(noise)
-        }
-
-        const frame = readCoilsResponse()
-
-        if (rnd(2) === 0) {
-          const at = 1 + rnd(frame.length - 1)
-          handler.handleData(frame.slice(0, at))
-          handler.handleData(frame.slice(at))
-        } else {
-          handler.handleData(frame)
-        }
-
-        let response
-        while ((response = handler.shift()) !== undefined) {
-          delivered += 1
-          assert.equal(1, response.body.fc, 'a response built from noise reached the caller')
-          assert.deepEqual(
-            [1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0],
-            response.body.valuesAsArray,
-            'a response built from noise reached the caller'
-          )
-        }
-      }
-
-      assert.ok(delivered > 1500, `expected the handler to keep recovering, got ${delivered}`)
-    })
-  })
 })

From de8d0b29b8e7e869fdf88f426c4fa79860ce0e6a Mon Sep 17 00:00:00 2001
From: Barneey96 <barnabas.ajtay@proton.me>
Date: Tue, 29 Sep 2026 13:12:06 +0200
Subject: [PATCH 6/7] feat: introduce esponse-body-handler interface

---
 package-lock.json                     |   4 +-
 package.json                          |   2 +-
 src/client-response-handler.ts        |  28 ++++
 src/modbus-client.ts                  |  19 +++
 src/modbus.ts                         |   1 +
 src/response/response-body-handler.ts |  12 ++
 src/rtu-client-response-handler.ts    |   2 +-
 src/rtu-response.ts                   |   7 +-
 src/tcp-client-response-handler.ts    |   2 +-
 src/tcp-response.ts                   |   7 +-
 test/custom-response-handler.test.js  | 186 ++++++++++++++++++++++++++
 11 files changed, 261 insertions(+), 9 deletions(-)
 create mode 100644 src/response/response-body-handler.ts
 create mode 100644 test/custom-response-handler.test.js

diff --git a/package-lock.json b/package-lock.json
index 3beabd3..6d8f388 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "jsmodbus",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "jsmodbus",
-      "version": "5.0.0",
+      "version": "5.0.1",
       "license": "MIT",
       "dependencies": {
         "commander": "^11.1.0",
diff --git a/package.json b/package.json
index a992265..5e93f4f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jsmodbus",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "Implementation for the Serial/TCP Modbus protocol.",
   "author": "Stefan Poeter <stefan.poeter@cloud-automation.de>",
   "main": "./dist/modbus.js",
diff --git a/src/client-response-handler.ts b/src/client-response-handler.ts
index 1225cb4..3df84f4 100644
--- a/src/client-response-handler.ts
+++ b/src/client-response-handler.ts
@@ -1,4 +1,6 @@
 import MBAbstractResponse from './abstract-response'
+import IResponseBodyHandler from './response/response-body-handler.js'
+import ResponseFactory from './response/response-factory.js'
 
 /** Modbus Client Repsonse Handler
  * @abstract
@@ -6,6 +8,7 @@ import MBAbstractResponse from './abstract-response'
 export default abstract class ModbusClientResponseHandler<ResType extends MBAbstractResponse = MBAbstractResponse> {
   protected _buffer: Buffer
   protected abstract _messages: ResType[]
+  protected readonly _customHandlers = new Map<number, IResponseBodyHandler>()
 
   /** Create new Modbus Client Response Handler */
   constructor () {
@@ -23,4 +26,29 @@ export default abstract class ModbusClientResponseHandler<ResType extends MBAbst
   public shift () {
     return this._messages.shift()
   }
+
+  /** Parse responses of a function code with a custom handler instead of the built-in one. */
+  public registerResponseHandler (fc: number, handler: IResponseBodyHandler) {
+    this._customHandlers.set(fc, handler)
+  }
+
+  /** Go back to the built-in parser for a function code. Returns true if a custom handler was removed. */
+  public unregisterResponseHandler (fc: number) {
+    return this._customHandlers.delete(fc)
+  }
+
+  /** Parse a response body with the custom handler of its function code, if there is one. */
+  protected _parseBody = (buffer: Buffer) => {
+    const handler = this._customHandlers.get(buffer[0])
+
+    if (!handler) {
+      return ResponseFactory.fromBuffer(buffer)
+    }
+
+    try {
+      return handler.fromBuffer(buffer)
+    } catch (e) {
+      return null
+    }
+  }
 }
diff --git a/src/modbus-client.ts b/src/modbus-client.ts
index 9208e78..01f393d 100644
--- a/src/modbus-client.ts
+++ b/src/modbus-client.ts
@@ -22,6 +22,7 @@ import MBClientResponseHandler from './client-response-handler.js'
 import { UserRequestError } from './errors'
 import { CastRequestBody } from './request-response-map'
 import { WriteMultipleCoilsResponseBody } from './response'
+import IResponseBodyHandler from './response/response-body-handler.js'
 import { PromiseUserRequest } from './user-request.js'
 
 /** Common Modbus Client
@@ -342,6 +343,24 @@ export default abstract class MBClient<S extends Stream.Duplex, Req extends Modb
     return this._requestHandler.customErrorRequest(err)
   }
 
+  /** Parse responses of a function code with a custom handler instead of the built-in one.
+   * The returned body is matched against the pending request as usual, so it has to carry
+   * the function code of the request (or be an exception response).
+   * @param {number} fc Function code
+   * @param {IResponseBodyHandler} handler Object with a fromBuffer (buffer) method.
+   */
+  public registerResponseHandler (fc: number, handler: IResponseBodyHandler) {
+    this._responseHandler.registerResponseHandler(fc, handler)
+  }
+
+  /** Remove a custom response handler and go back to the built-in parser.
+   * @param {number} fc Function code
+   * @returns {boolean} true if a custom handler was removed.
+   */
+  public unregisterResponseHandler (fc: number) {
+    return this._responseHandler.unregisterResponseHandler(fc)
+  }
+
   private _onData (data: Buffer) {
     debug('received data')
 
diff --git a/src/modbus.ts b/src/modbus.ts
index 7be1d90..f6e0899 100644
--- a/src/modbus.ts
+++ b/src/modbus.ts
@@ -68,6 +68,7 @@ export { default as ModbusAbstractRequest } from './abstract-request'
 export { default as ModbusAbstractResponse } from './abstract-response'
 export { default as MBClientRequestHandler } from './client-request-handler'
 export { default as ModbusClientResponseHandler } from './client-response-handler'
+export { default as ResponseBodyHandler } from './response/response-body-handler'
 export { default as ModbusClient } from './modbus-client'
 export * from './request-response-map'
 export { default as ModbusTCPRequest } from './tcp-request'
diff --git a/src/response/response-body-handler.ts b/src/response/response-body-handler.ts
new file mode 100644
index 0000000..740de32
--- /dev/null
+++ b/src/response/response-body-handler.ts
@@ -0,0 +1,12 @@
+import ModbusResponseBody from './response-body.js'
+
+/** Parses the response body of a single function code. The built-in response body
+ * classes (e.g. ReadHoldingRegistersResponseBody) satisfy it through their static fromBuffer.
+ */
+export default interface IResponseBodyHandler<Body extends ModbusResponseBody = ModbusResponseBody> {
+  /** @param {Buffer} buffer Starts at the function code. With Modbus/RTU the returned body's
+   *   byteCount decides how many bytes are consumed before the CRC.
+   * @returns {ModbusResponseBody | null} null if not enough data has arrived yet.
+   */
+  fromBuffer (buffer: Buffer): Body | null
+}
diff --git a/src/rtu-client-response-handler.ts b/src/rtu-client-response-handler.ts
index 71fade0..3c21c28 100644
--- a/src/rtu-client-response-handler.ts
+++ b/src/rtu-client-response-handler.ts
@@ -21,7 +21,7 @@ export default class ModbusRTUClientResponseHandler extends ModbusClientResponse
     debug('buffer', this._buffer)
 
     do {
-      const response = ModbusRTUResponse.fromBuffer(this._buffer)
+      const response = ModbusRTUResponse.fromBuffer(this._buffer, this._parseBody)
 
       if (!response) {
         debug('not enough data available to parse')
diff --git a/src/rtu-response.ts b/src/rtu-response.ts
index c903738..060f22e 100644
--- a/src/rtu-response.ts
+++ b/src/rtu-response.ts
@@ -49,7 +49,10 @@ export default class ModbusRTUResponse<ResBody extends ModbusResponseBody = Modb
       modbusBody)
   }
 
-  public static fromBuffer (buffer: Buffer) {
+  public static fromBuffer (
+    buffer: Buffer,
+    parseBody: (body: Buffer) => ModbusResponseBody | null = ResponseFactory.fromBuffer
+  ) {
     if (buffer.length < 1) {
       return null
     }
@@ -58,7 +61,7 @@ export default class ModbusRTUResponse<ResBody extends ModbusResponseBody = Modb
 
     debug('address', address, 'buffer', buffer)
 
-    const body = ResponseFactory.fromBuffer(buffer.slice(1))
+    const body = parseBody(buffer.slice(1))
 
     if (!body) {
       return null
diff --git a/src/tcp-client-response-handler.ts b/src/tcp-client-response-handler.ts
index a499870..295a936 100644
--- a/src/tcp-client-response-handler.ts
+++ b/src/tcp-client-response-handler.ts
@@ -23,7 +23,7 @@ export default class ModbusTCPClientResponseHandler extends ModbusClientResponse
     debug('buffer', this._buffer)
 
     do {
-      const response = ModbusTCPResponse.fromBuffer(this._buffer)
+      const response = ModbusTCPResponse.fromBuffer(this._buffer, this._parseBody)
 
       if (!response) {
         debug('not enough data available to parse')
diff --git a/src/tcp-response.ts b/src/tcp-response.ts
index 8fbb8c1..3f7adf7 100644
--- a/src/tcp-response.ts
+++ b/src/tcp-response.ts
@@ -70,7 +70,10 @@ export default class ModbusTCPResponse<ResBody extends ModbusResponseBody = Modb
    * @param {Buffer} buffer
    * @returns {ModbusTCPResponse} Returns null if not enough data located in the buffer.
    */
-  public static fromBuffer (buffer: Buffer) {
+  public static fromBuffer (
+    buffer: Buffer,
+    parseBody: (body: Buffer) => ModbusResponseBody | null = ResponseFactory.fromBuffer
+  ) {
     try {
       const id = buffer.readUInt16BE(0)
       const protocol = buffer.readUInt16BE(2)
@@ -80,7 +83,7 @@ export default class ModbusTCPResponse<ResBody extends ModbusResponseBody = Modb
       debug('tcp header complete, id', id, 'protocol', protocol, 'length', length, 'unitId', unitId)
       debug('buffer', buffer)
 
-      const body = ResponseFactory.fromBuffer(buffer.slice(7, 7 + length - 1))
+      const body = parseBody(buffer.slice(7, 7 + length - 1))
 
       if (!body) {
         debug('not enough data for a response body')
diff --git a/test/custom-response-handler.test.js b/test/custom-response-handler.test.js
new file mode 100644
index 0000000..b82b2ed
--- /dev/null
+++ b/test/custom-response-handler.test.js
@@ -0,0 +1,186 @@
+'use strict'
+
+/* global describe, it, beforeEach */
+
+const assert = require('assert')
+const EventEmitter = require('events')
+const Modbus = require('../')
+
+const ModbusRTUClientResponseHandler = require('../dist/rtu-client-response-handler.js').default
+const ModbusTCPClientResponseHandler = require('../dist/tcp-client-response-handler.js').default
+
+const { ReadHoldingRegistersResponseBody } = Modbus.responses
+
+/* Parses a read holding registers response that always carries a single register,
+ * whatever the byte count field says. */
+const singleRegisterHandler = {
+  calls: 0,
+  fromBuffer (buffer) {
+    this.calls++
+    if (buffer.length < 4) {
+      return null
+    }
+    const payload = buffer.slice(2, 4)
+    return new ReadHoldingRegistersResponseBody(2, [payload.readUInt16BE(0)], payload)
+  }
+}
+
+describe('Custom Response Handler Tests.', function () {
+  beforeEach(function () {
+    singleRegisterHandler.calls = 0
+  })
+
+  describe('Modbus/RTU Client Response Handler.', function () {
+    let handler
+
+    beforeEach(function () {
+      handler = new ModbusRTUClientResponseHandler()
+    })
+
+    it('should consume as many bytes as the custom body reports', function () {
+      handler.registerResponseHandler(0x03, singleRegisterHandler)
+
+      handler.handleData(Buffer.from([
+        0x01, // address
+        0x03, // function code
+        0xff, // broken byte count
+        0x12, 0x34, // register
+        0xcd, 0xab, // crc
+        0x01, // address of the next response
+        0x03, 0x02, 0x56, 0x78, 0x34, 0x12
+      ]))
+
+      const first = handler.shift()
+      const second = handler.shift()
+
+      assert.deepEqual([0x1234], first.body.valuesAsArray)
+      assert.equal(0xabcd, first.crc)
+      assert.deepEqual([0x5678], second.body.valuesAsArray)
+      assert.equal(0x1234, second.crc)
+      assert.strictEqual(undefined, handler.shift())
+    })
+
+    it('should wait for more data while the custom handler returns null', function () {
+      handler.registerResponseHandler(0x03, singleRegisterHandler)
+
+      handler.handleData(Buffer.from([0x01, 0x03, 0xff, 0x12]))
+      assert.strictEqual(undefined, handler.shift())
+
+      handler.handleData(Buffer.from([0x34, 0xcd, 0xab]))
+      assert.deepEqual([0x1234], handler.shift().body.valuesAsArray)
+    })
+
+    it('should leave other function codes to the built-in parser', function () {
+      handler.registerResponseHandler(0x03, singleRegisterHandler)
+
+      handler.handleData(Buffer.from([0x01, 0x01, 0x01, 0x01, 0xcd, 0xab]))
+
+      assert.equal(0, singleRegisterHandler.calls)
+      assert.equal(0x01, handler.shift().body.fc)
+    })
+
+    it('should use the built-in parser after unregistering', function () {
+      handler.registerResponseHandler(0x03, singleRegisterHandler)
+
+      assert.equal(true, handler.unregisterResponseHandler(0x03))
+      assert.equal(false, handler.unregisterResponseHandler(0x03))
+
+      handler.handleData(Buffer.from([0x01, 0x03, 0x04, 0x12, 0x34, 0x56, 0x78, 0xcd, 0xab]))
+
+      assert.equal(0, singleRegisterHandler.calls)
+      assert.deepEqual([0x1234, 0x5678], handler.shift().body.valuesAsArray)
+    })
+
+    it('should treat a throwing handler like an incomplete response', function () {
+      handler.registerResponseHandler(0x03, { fromBuffer: () => { throw new Error('boom') } })
+
+      handler.handleData(Buffer.from([0x01, 0x03, 0x02, 0x12, 0x34, 0xcd, 0xab]))
+
+      assert.strictEqual(undefined, handler.shift())
+    })
+  })
+
+  describe('Modbus/TCP Client Response Handler.', function () {
+    it('should pass exactly the PDU to the custom handler', function () {
+      const handler = new ModbusTCPClientResponseHandler()
+      let received
+
+      handler.registerResponseHandler(0x03, {
+        fromBuffer (buffer) {
+          received = buffer
+          return singleRegisterHandler.fromBuffer(buffer)
+        }
+      })
+
+      handler.handleData(Buffer.from([
+        0x00, 0x01, // transaction id
+        0x00, 0x00, // protocol
+        0x00, 0x05, // length
+        0x01, // unit id
+        0x03, 0xff, 0x12, 0x34 // pdu with broken byte count
+      ]))
+
+      assert.deepEqual(Buffer.from([0x03, 0xff, 0x12, 0x34]), received)
+      assert.deepEqual([0x1234], handler.shift().body.valuesAsArray)
+    })
+  })
+
+  describe('Modbus Client.', function () {
+    let socket
+
+    beforeEach(function () {
+      socket = new EventEmitter()
+      socket.write = function () {}
+    })
+
+    it('should resolve the request with the body of the custom handler', function (done) {
+      const client = new Modbus.client.TCP(socket)
+      client.registerResponseHandler(0x03, singleRegisterHandler)
+
+      socket.emit('connect')
+
+      client.readHoldingRegisters(0, 1)
+        .then(function (resp) {
+          assert.equal(1, singleRegisterHandler.calls)
+          assert.deepEqual([0x1234], resp.response.body.valuesAsArray)
+          done()
+        }).catch(done)
+
+      socket.emit('data', Buffer.from([
+        0x00, 0x01, // transaction id
+        0x00, 0x00, // protocol
+        0x00, 0x05, // length
+        0x01, // unit id
+        0x03, 0xff, 0x12, 0x34
+      ]))
+    })
+
+    it('should unregister a custom handler on the client', function () {
+      const client = new Modbus.client.RTU(new EventEmitter(), 1)
+      client.registerResponseHandler(0x03, singleRegisterHandler)
+
+      assert.equal(true, client.unregisterResponseHandler(0x03))
+      assert.equal(false, client.unregisterResponseHandler(0x03))
+    })
+
+    it('should keep custom handlers per client', function (done) {
+      const otherClient = new Modbus.client.TCP(new EventEmitter())
+      const client = new Modbus.client.TCP(socket)
+      otherClient.registerResponseHandler(0x03, singleRegisterHandler)
+
+      socket.emit('connect')
+
+      client.readHoldingRegisters(0, 1)
+        .then(function (resp) {
+          assert.equal(0, singleRegisterHandler.calls)
+          assert.deepEqual([0x1234], resp.response.body.valuesAsArray)
+          done()
+        }).catch(done)
+
+      socket.emit('data', Buffer.from([
+        0x00, 0x01, 0x00, 0x00, 0x00, 0x05, 0x01,
+        0x03, 0x02, 0x12, 0x34
+      ]))
+    })
+  })
+})

From fc0291c95ecc0446e926bb8e673d898f87d14072 Mon Sep 17 00:00:00 2001
From: Barneey96 <barnabas.ajtay@proton.me>
Date: Tue, 29 Sep 2026 13:33:12 +0200
Subject: [PATCH 7/7] feat: add public discardBuffer method to
 client-response-handler

---
 src/client-response-handler.ts       |  9 +++++++++
 src/modbus-client.ts                 |  8 ++++++++
 test/custom-response-handler.test.js | 22 ++++++++++++++++++++++
 3 files changed, 39 insertions(+)

diff --git a/src/client-response-handler.ts b/src/client-response-handler.ts
index 3df84f4..5488aa3 100644
--- a/src/client-response-handler.ts
+++ b/src/client-response-handler.ts
@@ -27,6 +27,15 @@ export default abstract class ModbusClientResponseHandler<ResType extends MBAbst
     return this._messages.shift()
   }
 
+  /** Drop whatever is left in the receive buffer.
+   * @returns {number} The number of discarded bytes.
+   */
+  public discardBuffer (): number {
+    const discarded = this._buffer.length
+    this._buffer = Buffer.alloc(0)
+    return discarded
+  }
+
   /** Parse responses of a function code with a custom handler instead of the built-in one. */
   public registerResponseHandler (fc: number, handler: IResponseBodyHandler) {
     this._customHandlers.set(fc, handler)
diff --git a/src/modbus-client.ts b/src/modbus-client.ts
index 01f393d..aec2c4a 100644
--- a/src/modbus-client.ts
+++ b/src/modbus-client.ts
@@ -343,6 +343,14 @@ export default abstract class MBClient<S extends Stream.Duplex, Req extends Modb
     return this._requestHandler.customErrorRequest(err)
   }
 
+  /** Drop whatever is left in the receive buffer, e.g. the rest of a response whose request
+   * timed out.
+   * @returns {number} The number of discarded bytes.
+   */
+  public discardResponseBuffer (): number {
+    return this._responseHandler.discardBuffer()
+  }
+
   /** Parse responses of a function code with a custom handler instead of the built-in one.
    * The returned body is matched against the pending request as usual, so it has to carry
    * the function code of the request (or be an exception response).
diff --git a/test/custom-response-handler.test.js b/test/custom-response-handler.test.js
index b82b2ed..2d4a6f5 100644
--- a/test/custom-response-handler.test.js
+++ b/test/custom-response-handler.test.js
@@ -155,6 +155,28 @@ describe('Custom Response Handler Tests.', function () {
       ]))
     })
 
+    it('should parse the next response after discarding a truncated one', function (done) {
+      const client = new Modbus.client.TCP(socket)
+
+      socket.emit('connect')
+
+      /* the rest of a frame whose request was given up on */
+      socket.emit('data', Buffer.from([0x00, 0x07, 0x00, 0x00, 0x00, 0x05]))
+      assert.equal(6, client.discardResponseBuffer())
+      assert.equal(0, client.discardResponseBuffer())
+
+      client.readHoldingRegisters(0, 1)
+        .then(function (resp) {
+          assert.deepEqual([0x1234], resp.response.body.valuesAsArray)
+          done()
+        }).catch(done)
+
+      socket.emit('data', Buffer.from([
+        0x00, 0x01, 0x00, 0x00, 0x00, 0x05, 0x01,
+        0x03, 0x02, 0x12, 0x34
+      ]))
+    })
+
     it('should unregister a custom handler on the client', function () {
       const client = new Modbus.client.RTU(new EventEmitter(), 1)
       client.registerResponseHandler(0x03, singleRegisterHandler)