}

    private static ASN1Sequence parseSequence(byte[] token) throws PACDecodingException {
        if (token.length <= 0) {
            throw new PACDecodingException("Empty kerberos ApReq");
        }

        ASN1Sequence sequence;
        try {
            try (ASN1InputStream stream = new ASN1InputStream(new ByteArrayInputStream(token))) {

        // Act + Assert
        PACDecodingException ex = assertThrows(PACDecodingException.class, () -> new KerberosApRequest(empty, new KerberosKey[0]));
        assertTrue(ex.getMessage().contains("Empty kerberos ApReq"));
    }

    @Test
    @DisplayName("byte[] ctor: malformed DER is wrapped as PACDecodingException (IOException path)")
    void byteArrayConstructor_malformedDER_throwsWrapped() {