@DisplayName("seq ctor: invalid pvno values throw")
    void sequenceConstructor_invalidVersion_throws(int badPvno) throws Exception {
        // Arrange: Build sequence with invalid version and otherwise valid tags
        ASN1EncodableVector v = new ASN1EncodableVector();
        v.add(new DERTaggedObject(true, 0, new ASN1Integer(badPvno))); // wrong pvno

            ASN1TaggedObject tagged = ASN1Util.as(ASN1TaggedObject.class, fields.nextElement());
            switch (tagged.getTagNo()) {
            case 0:
                ASN1Integer pvno = ASN1Util.as(ASN1Integer.class, tagged);
                if (!pvno.getValue().equals(new BigInteger(KerberosConstants.KERBEROS_VERSION))) {
                    throw new PACDecodingException("Invalid kerberos version");
                }
                break;

    void testConstructorWithWrongTagClass() throws IOException {
        // Create AP-REQ structure
        ASN1Sequence apReqSequence = new DERSequence(new ASN1Encodable[] { new DERTaggedObject(true, 0, new ASN1Integer(5)), // pvno
                new DERTaggedObject(true, 1, new ASN1Integer(14)), // msg-type
        });

        // Create CONTEXT tagged object instead of APPLICATION

        ASN1EncodableVector encPart = new ASN1EncodableVector();
        encPart.add(new DERTaggedObject(true, 0, new ASN1Integer(encType)));
        // Add kvno (key version number) field that is optional but expected when accessing index 2
        encPart.add(new DERTaggedObject(true, 1, new ASN1Integer(1))); // kvno
        encPart.add(new DERTaggedObject(true, 2, new DEROctetString(encryptedData)));
        v.add(new DERTaggedObject(true, 3, new DERSequence(encPart)));