// yes, there really is non ASN.1/DER data inside the tagged object
            int read = 0;
            int readLow = stream.read() & 0xff;
            int readHigh = stream.read() & 0xff;
            read = ( readHigh << 8 ) + readLow;
            if ( read != 0x01 )
                throw new PACDecodingException("Malformed kerberos token");

        int ftag = in.read();
        int tag = readTagNumber(in, ftag);
        if ( tag != expectTag ) {
            throw new IOException("Unexpected tag " + tag);
        }
        int length = readLength(in, limit, false);
        byte[] content = new byte[length];
        in.read(content);
        return content;
    }