assertThrows(CIFSException.class, () -> ctx.initSecContext(buf, 3, 1));
            assertThrows(CIFSException.class, () -> ctx.initSecContext(buf, 2, 2));
        }

        @Test
        @DisplayName("initSecContext null token edge cases")
        void testInitSecContextNullToken() throws Exception {
            DummySSPContext ctx = new DummySSPContext(new byte[] { 1 }, false, null, null, 0, false);

        // Test that calling initSecContext in an invalid state throws an exception
        when(mockAuth.getDomain()).thenReturn(domain);
        when(mockAuth.getUsername()).thenReturn(username);
        when(mockAuth.getPassword()).thenReturn(password);

        NtlmContext context = new NtlmContext(mockAuth, true);
        context.initSecContext(new byte[0], 0, 0); // state -> 2

        CIFSException ex = assertThrows(CIFSException.class, () -> ctx.initSecContext(new byte[] { firstByte }, 0, 1));
        assertEquals("Invalid token", ex.getMessage());

        // Ensure mechContext was not engaged due to early failure
        verify(this.mechContext, never()).initSecContext(any(), anyInt(), anyInt());
    }

    @Test
    @DisplayName("initSecContext with null buffer and non-zero len throws NPE")

    }

    @Test
    @DisplayName("initSecContext wraps GSSException into SmbAuthException")
    void initSecContext_failure_wraps() throws Exception {
        when(gssContext.initSecContext(any(), anyInt(), anyInt())).thenThrow(new GSSException(GSSException.DEFECTIVE_TOKEN));
        assertThrows(SmbAuthException.class, () -> ctx.initSecContext(new byte[] {}, 0, 0));
    }

     * Initialize the GSSContext to provide SPNEGO feature.
     *
     * @param inputBuf
     * @param offset
     * @param len
     * @return response token
     */
    @Override
    public byte[] initSecContext(final byte[] inputBuf, final int offset, final int len) throws CIFSException {
        SpnegoToken resp;
        if (this.completed) {
            throw new CIFSException("Already complete");
        }

     * @param len length of token data
     * @return result token
     * @throws SmbException if an SMB protocol error occurs
     * @throws CIFSException if a general CIFS error occurs
     */
    byte[] initSecContext(byte[] token, int off, int len) throws CIFSException;

    /**
     * Gets the NetBIOS name of the remote endpoint.
     * @return the name of the remote endpoint
     */
    String getNetbiosName();

    /**

        }
        throw new SmbException("ExtendedGSSContext is not implemented by GSSContext");
    }

    @Override
    public byte[] initSecContext(byte[] token, int off, int len) throws SmbException {
        try {
            return this.gssContext.initSecContext(token, off, len);
        } catch (GSSException e) {
            throw new SmbAuthException("GSSAPI mechanism failed", e);
        }
    }

     * @param len length of token data
     * @return the output token bytes
     * @throws SmbException if an error occurs during context initialization
     */
    public byte[] initSecContext(byte[] token, final int offset, final int len) throws SmbException {
        switch (state) {
        case 1:
            final Type1Message msg1 = new Type1Message(ntlmsspFlags, auth.getDomain(), workstation);

        if (s != null) {
            try {
                return Subject.doAs(s,
                        (PrivilegedExceptionAction<byte[]>) () -> ctx.initSecContext(token, 0, token == null ? 0 : token.length));
            } catch (PrivilegedActionException e) {
                if (e.getException() instanceof SmbException) {
                    throw (SmbException) e.getException();

     * @param targetName
     *            the target's SPN
     */
    public void setTargetName(final String targetName) {
        this.targetName = targetName;
    }

    @Override
    public byte[] initSecContext(final byte[] token, final int offset, final int len) throws SmbException {
        return switch (this.state) {
        case 1 -> makeNegotiate(token);
        case 2 -> makeAuthenticate(token);