// Provide a page with no valid items so that advance returns null and triggers close in next()
        TestIterator it = TestIterator.create(tree, parent, "*", null, 0, initial, List.of(new FileEntry[][] { new FileEntry[] {} }))
                .throwOnCloseInternal();

        // Act: first next() returns initial, second triggers close which throws internally but is handled
        assertTrue(it.hasNext());

        assertTrue(ex.getMessage().contains("Malformed Kerberos Ticket"));
    }

    @Test
    @DisplayName("byte[] ctor: top-level non-SEQUENCE triggers PACDecodingException (type mismatch)")
    void byteArrayConstructor_topLevelNotSequence_throws() throws Exception {
        // Arrange: Encoded INTEGER instead of SEQUENCE

        assertEquals("smb://server/share/file", a.getCanonicalURL());
    }

    @Test
    @DisplayName("Invalid path triggers RuntimeCIFSException during canonicalize")
    void testCanonicalizeInvalidPath() {
        SmbResourceLocatorImpl a = locator("smb:invalid-no-slash");
        // Any accessor that triggers canonicalizePath should throw
        assertThrows(RuntimeCIFSException.class, a::getURLPath);

        verify(tc, never()).getConfig();
        verifyNoInteractions(config);
    }

    @Test
    @DisplayName("createContext: Kerberos present but forceFallback triggers NTLM path")
    void createContext_forceFallback_triggersNtlmAndFailsOnNonNtlmToken() throws CIFSException {
        when(tc.getConfig()).thenReturn(config);
        when(config.isAllowNTLMFallback()).thenReturn(true);

        }

        @Test
        @DisplayName("Weak resolve via initContext triggers only once on accessors")
        void testResolveWeakInitContext() throws SmbException, CIFSException {
            SID sid = new SID("S-1-5-21-1-2");
            sid.initContext("srv", mockCtx);

            // First accessor triggers resolution
            int t1 = sid.getType();

        // Validates usage counting and that an extra release() throws RuntimeCIFSException
        // First close -> usage 1 -> 0, triggers treeConnection.release()
        handle.close();
        verify(treeConnection, times(1)).release();

        // Second release -> usage 0 -> -1 triggers RuntimeCIFSException
        RuntimeCIFSException ex = assertThrows(RuntimeCIFSException.class, () -> handle.release());

        SmbTreeImpl tree = mock(SmbTreeImpl.class);
        when(tree.acquire(false)).thenReturn(tree);
        when(tree.acquire()).thenReturn(tree);

        setTree(c, tree);

        // Act: first acquire triggers tree.acquire()
        c.acquire();
        verify(tree, times(1)).acquire();

        // Act: second acquire does not call tree.acquire again
        c.acquire();
        verify(tree, times(1)).acquire();

            SmbResourceLocator locator = mock(SmbResourceLocator.class);
            when(parent.getLocator()).thenReturn(locator);
            // Host is empty -> triggers master browser path
            URL anyUrlWithEmptyHost = new URL("file:/");
            when(locator.getURL()).thenReturn(anyUrlWithEmptyHost);

        block.headerStart = 0;

        byte[] buf = new byte[64];
        buf[0] = 4; // wordCount
        buf[1] = 0x42; // andxCommand
        // andxOffset = 0 triggers workaround -> treat as no andx
        ServerMessageBlock.writeInt2(0, buf, 3);
        ServerMessageBlock.writeInt2(10, buf, 9); // byteCount

        int n = block.readAndXWireFormat(buf, 0);

        for (int i = 0; i < threadCount; i++) {
            final int index = i;
            threads[i] = new Thread(() -> {
                try {
                    // Call processRequest which triggers initialization
                    client.doGet("file://nonexistent.txt");
                } catch (Exception e) {
                    // Expected for nonexistent file
                }