assertTrue(ex.getMessage().contains("Malformed Kerberos Ticket"));
    }

    @Test
    @DisplayName("byte[] ctor: top-level non-SEQUENCE triggers PACDecodingException (type mismatch)")
    void byteArrayConstructor_topLevelNotSequence_throws() throws Exception {
        // Arrange: Encoded INTEGER instead of SEQUENCE

        // Provide a page with no valid items so that advance returns null and triggers close in next()
        TestIterator it = TestIterator.create(tree, parent, "*", null, 0, initial, List.of(new FileEntry[][] { new FileEntry[] {} }))
                .throwOnCloseInternal();

        // Act: first next() returns initial, second triggers close which throws internally but is handled
        assertTrue(it.hasNext());

        }

        @Test
        @DisplayName("Weak resolve via initContext triggers only once on accessors")
        void testResolveWeakInitContext() throws SmbException, CIFSException {
            SID sid = new SID("S-1-5-21-1-2");
            sid.initContext("srv", mockCtx);

            // First accessor triggers resolution
            int t1 = sid.getType();

        assertEquals("smb://server/share/file", a.getCanonicalURL());
    }

    @Test
    @DisplayName("Invalid path triggers RuntimeCIFSException during canonicalize")
    void testCanonicalizeInvalidPath() {
        SmbResourceLocatorImpl a = locator("smb:invalid-no-slash");
        // Any accessor that triggers canonicalizePath should throw
        assertThrows(RuntimeCIFSException.class, a::getURLPath);

        verify(tc, never()).getConfig();
        verifyNoInteractions(config);
    }

    @Test
    @DisplayName("createContext: Kerberos present but forceFallback triggers NTLM path")
    void createContext_forceFallback_triggersNtlmAndFailsOnNonNtlmToken() throws CIFSException {
        when(tc.getConfig()).thenReturn(config);
        when(config.isAllowNTLMFallback()).thenReturn(true);

        // Validates usage counting and that an extra release() throws RuntimeCIFSException
        // First close -> usage 1 -> 0, triggers treeConnection.release()
        handle.close();
        verify(treeConnection, times(1)).release();

        // Second release -> usage 0 -> -1 triggers RuntimeCIFSException
        RuntimeCIFSException ex = assertThrows(RuntimeCIFSException.class, () -> handle.release());

        SmbTreeImpl tree = mock(SmbTreeImpl.class);
        when(tree.acquire(false)).thenReturn(tree);
        when(tree.acquire()).thenReturn(tree);

        setTree(c, tree);

        // Act: first acquire triggers tree.acquire()
        c.acquire();
        verify(tree, times(1)).acquire();

        // Act: second acquire does not call tree.acquire again
        c.acquire();
        verify(tree, times(1)).acquire();

            SmbResourceLocator locator = mock(SmbResourceLocator.class);
            when(parent.getLocator()).thenReturn(locator);
            // Host is empty -> triggers master browser path
            URL anyUrlWithEmptyHost = new URL("file:/");
            when(locator.getURL()).thenReturn(anyUrlWithEmptyHost);

        assertNotNull(result);
    }

    public void test_getLabelTypeItemList_nullLabelTypeItemList() {
        // Test when labelTypeItemList is null (triggers init)
        List<Map<String, String>> result = labelTypeHelper.getLabelTypeItemList(SearchRequestType.SEARCH, Locale.ROOT);
        assertNotNull(result);
    }

    public void test_getMatchedLabelValueSet() {

   * and {@link java.util.concurrent.CompletableFuture#handleAsync} when used along with {@link
   * #transform}.
   *
   * @param exceptionType the exception type that triggers use of {@code fallback}. The exception
   *     type is matched against the input's exception. "The input's exception" means the cause of