if (hdrStart + securityBufferOffset < hdrStart || // Check for integer overflow
                    hdrStart + securityBufferOffset + securityBufferLength < 0 || // Check for integer overflow
                    hdrStart + securityBufferOffset + securityBufferLength > buffer.length) {

        bufferIndex += 4;

        final int securityBufferOffset = SMBUtil.readInt2(buffer, bufferIndex);
        final int securityBufferLength = SMBUtil.readInt2(buffer, bufferIndex + 2);
        bufferIndex += 4;

        final int pad = bufferIndex - (getHeaderStart() + securityBufferOffset);
        this.blob = new byte[securityBufferLength];

        // Verify token content at the security buffer offset
        int securityBufferOffset = SMBUtil.readInt2(buffer, bodyOffset + 12);
        byte[] actualToken = new byte[TEST_TOKEN.length];
        System.arraycopy(buffer, headerStart + securityBufferOffset, actualToken, 0, TEST_TOKEN.length);
        assertArrayEquals(TEST_TOKEN, actualToken);
    }

    @Test

        // SessionId at +40 (sync header)
        SMBUtil.writeInt8(sessionId, buf, start + 40);
    }

    /**
     * Build a SESSION_SETUP response body with specified flags and security blob.
     * securityBufferOffset is set relative to header start.
     */
    private void buildSessionSetupBody(byte[] buf, int headerStart, int bodyStart, int sessionFlags, int secBufOffset, byte[] blob) {
        // StructureSize (must be 9)