throw new PACDecodingException("Invalid kerberos request");
                }
                break;
            case 2:
                DERBitString bitString = ASN1Util.as(DERBitString.class, tagged);
                this.apOptions = bitString.getBytes()[0];
                break;
            case 3:
                ASN1TaggedObject derTicket = ASN1Util.as(ASN1TaggedObject.class, tagged);

    @Test
    @DisplayName("Tag [3] MIC with non-OctetString is ignored (no crash)")
    void testMicTag3NonOctetIgnored() throws Exception {
        // Manually craft a token where field [3] is not an OctetString (e.g., BitString)
        ASN1EncodableVector fields = new ASN1EncodableVector();
        // Add a dummy [3] BIT STRING which should be ignored by implementation
        fields.add(new DERTaggedObject(true, 3, new DERBitString(0xA5)));