assertTrue(ex.getMessage().contains("Empty kerberos ApReq"));
    }

    @Test
    @DisplayName("byte[] ctor: malformed DER is wrapped as PACDecodingException (IOException path)")
    void byteArrayConstructor_malformedDER_throwsWrapped() {
        // Arrange: Truncated SEQUENCE (0x30 len=2 but only 1 byte of content)
        byte[] malformed = new byte[] { 0x30, 0x02, 0x01 };

        // Act + Assert