I have updated the PCAP schema on github to illustrate this issue.
This is a pull request (code review) of the changes https://github.com/DFDLSchemas/PCAP/pull/10
In the PCAP schema the IPSrcGrp group ref appears immediately before the IPSrc element. Similarly the IPDestGrp reference appears immediately before the IPDest element.
These groups contain elements which are the individual binary bytes of the IP Source and IP Dest addresses. They are 4 unsigned bytes.
When parsing these are parsed and then their values concatenated as strings into a string like "22.214.171.124".
When unparsing, these groups use dfdl:outputValueCalc to take apart a string like "126.96.36.199" (which appears in the infoset after parsing), back into its individual digits 1, 2, 3, 4, and creates an unsignedByte value of each number.
The problem is, these groups are absolute nonsense if you view the dfdl:newVariableInstance defaultValue expression as being evaluated at parse time. The expression is for use only at unparse time and immediately does a forward reference to the following IPSrc member containing the "188.8.131.52" type string.
Without some sort of additional property on dfdl:newVariableInstance and dfdl:setVariable to indicate that this only should be evaluated at unparse time, there is no way to suppress evaluation and perform it only at unparse time.
I suggest we need an additional property on newVariableInstance and setVariable which I suggest is called 'direction', with values 'parse', 'unparse', 'both'. This property defaults to 'both', but if set to 'unparse' only evaluates the expression (and binds/sets variable) during that direction of processing.