throw new PACDecodingException("Malformed kerberos token");
            }

            ASN1TaggedObject mechToken = ASN1Util.as(ASN1TaggedObject.class, stream.readObject());
            if (mechToken == null || mechToken.getTagClass() != BERTags.APPLICATION
                    || !(mechToken.getBaseObject() instanceof ASN1Sequence)) {
                throw new PACDecodingException("Malformed kerberos token");
            }

    }

    /**
     * Test constructor with KERB_CHECKSUM_HMAC_MD5 type.
     *
     * @throws IOException if an I/O error occurs
     * @throws PACDecodingException if the PAC is malformed
     */
    @Test
    void testConstructorKerbChecksumHmacMd5() throws IOException, PACDecodingException {
        // Prepare data
        ByteArrayOutputStream baos = new ByteArrayOutputStream();

# Test file for malformed robots.txt parsing
# This file contains various malformed directives that should be handled gracefully

# Case 1: Directives before any User-agent (should be ignored)
Disallow: /orphaned1/
Allow: /orphaned2/

# Case 2: Valid user-agent with various malformed directives
User-agent: GoodBot
Disallow: /admin/
InvalidDirective: some-value
unknown-field: test
Disallow /missing-colon

                    throw new PACDecodingException("Malformed Kerberos Ticket");
                }
                try {
                    this.ticket = new KerberosTicket(derTicket.getBaseObject().getEncoded(), this.apOptions, keys);
                } catch (IOException e) {
                    throw new PACDecodingException("Malformed Kerberos Ticket", e);
                }
                break;

          }
          else -> return false // Malformed.
        }
      }
      pos++ // Consume '-'.
    }

    var n = INITIAL_N
    var i = 0
    var bias = INITIAL_BIAS

    while (pos < limit) {
      val oldi = i
      var w = 1
      for (k in BASE until Int.MAX_VALUE step BASE) {
        if (pos == limit) return false // Malformed.
        val c = string[pos++]
        val digit =

    }

    @Test
    @DisplayName("byte[] ctor: malformed DER is wrapped as PACDecodingException (IOException path)")
    void byteArrayConstructor_malformedDER_throwsWrapped() {
        // Arrange: Truncated SEQUENCE (0x30 len=2 but only 1 byte of content)
        byte[] malformed = new byte[] { 0x30, 0x02, 0x01 };

        // Act + Assert

     * @throws PACDecodingException if the string structure is malformed
     */
    public PacUnicodeString readUnicodeString() throws IOException, PACDecodingException {
        final short length = readShort();
        final short maxLength = readShort();
        final int pointer = readInt();

        if (maxLength < length) {
            throw new PACDecodingException("Malformed string in PAC");
        }

    }

    @Test
    @DisplayName("parsing malformed token throws IOException")
    void testMalformedToken() {
        byte[] bad = new byte[] { 0x01, 0x02, 0x03 }; // not a valid ASN.1 tagged object
        assertThrows(IOException.class, () -> new NegTokenTarg(bad), "Malformed byte[] should cause IOException");
    }

    @Test

     * @param data the raw PAC data bytes
     * @param keys map of Kerberos keys for signature validation
     * @throws PACDecodingException if the PAC data is malformed or signature validation fails
     */
    public Pac(byte[] data, Map<Integer, KerberosKey> keys) throws PACDecodingException {
        byte[] checksumData = data.clone();
        try {

    private byte[] checksum;

    /**
     * Constructs a PacSignature by parsing the provided data.
     *
     * @param data the raw signature data to parse
     * @throws PACDecodingException if the data is malformed or cannot be parsed
     */
    public PacSignature(final byte[] data) throws PACDecodingException {
        try {