assertEquals(expectedNt, actual.get(), String.format("NTSTATUS for %08x should be %08x", dosErr, expectedNt));
    }

    @Test
    @DisplayName("Unknown DOS error code yields empty Optional")
    void testUnknownCode() {
        Optional<Integer> noMatch = findNtStatus(0xdeadbeef);
        assertFalse(noMatch.isPresent(), "Mapping for unknown code should be absent");
    }

    @Test

        verify(spyAuth, times(1)).getPasswordAsCharArray();
    }

    @Test
    @DisplayName("clone: copies fields and cached subject; instances are independent")
    void testCloneCopiesFieldsAndIndependence() throws Exception {
        // Use configuration-based constructor to also exercise copying of configuration/service fields
        JAASAuthenticator orig = new JAASAuthenticator(new HashMap<String, String>(), "DOM", "user", "pass");

class StaticJAASConfigurationTest {

    // Constants used in assertions
    private static final String EXPECTED_LOGIN_MODULE = "com.sun.security.auth.module.Krb5LoginModule";

    @Test
    @DisplayName("Default constructor yields REQUIRED Krb5 entry with empty options")
    void defaultConstructor_producesRequiredKrb5EntryWithEmptyOptions() {
        // Arrange
        StaticJAASConfiguration cfg = new StaticJAASConfiguration();

        // Act

        // Act
        itr.remove();

        // Assert
        verify(delegate, times(1)).remove();
    }

    @Test
    @DisplayName("Edge: empty delegate yields no elements")
    void emptyDelegate_hasNoNext() {
        // Arrange - no parent setup needed since no URLs are created
        when(delegate.hasNext()).thenReturn(false);

        // Arrange
        SecurityBlob blob = new SecurityBlob(new byte[] { 1, 2, 3 });

        // Force internal field to null via reflection to exercise defensive branch
        Field field = SecurityBlob.class.getDeclaredField("b");
        field.setAccessible(true);
        field.set(blob, null);

        // Act & Assert
        assertEquals(0, blob.length(), "length() should return 0 when internal array is null");

        ASN1ObjectIdentifier[] mechs = ctx.getSupportedMechs();
        assertNotNull(mechs);
        assertArrayEquals(Kerb5Context.SUPPORTED_MECHS, mechs);
    }

    @Test
    @DisplayName("getFlags with all false yields 0")
    void getFlags_allFalse() {
        when(gssContext.getCredDelegState()).thenReturn(false);
        when(gssContext.getMutualAuthState()).thenReturn(false);

        Class<?> cls = req.getClass().getSuperclass(); // ServerMessageBlock2Request
        Field f = cls.getSuperclass().getDeclaredField("next"); // ServerMessageBlock2.next
        f.setAccessible(true);
        return f.get(req);
    }

    /**
     * Reflectively set the private 'results' field on Smb2QueryDirectoryResponse.
     */

        verify(nsc, times(1)).getAllByName("server", true);
        assertTrue(l3.hasNextAddress());
        assertSame(a3, l3.getNextAddress());
        assertFalse(l3.hasNextAddress());

        // UnknownHostException yields CIFSException
        when(nsc.getAllByName("badhost", true)).thenThrow(new UnknownHostException("nope"));
        SmbResourceLocatorImpl bad = locator("smb://badhost/");

	return d, nil
}

// configReader returns a PutObjReader and ObjectOptions needed to save config
// using a PutObject API. PutObjReader encrypts json encoded tier configurations
// if KMS is enabled, otherwise simply yields the json encoded bytes as is.
// Similarly, ObjectOptions value depends on KMS' status.
func (config *TierConfigMgr) configReader(ctx context.Context) (*PutObjReader, *ObjectOptions, error) {
	b, err := config.Bytes()

    }

    public void test_setResponseFields() {
        String[] fields = { "field1", "field2", "field3" };
        queryFieldConfig.setResponseFields(fields);

        assertSame(fields, queryFieldConfig.responseFields);
    }

    public void test_getScrollResponseFields() {
        String[] fields = { "scroll1", "scroll2", "scroll3" };
        queryFieldConfig.setScrollResponseFields(fields);