assertTrue(ex.getMessage().contains("Invalid field in kerberos ticket"));
    }

    @Test
    @DisplayName("seq ctor: tag 3 with wrong tag class is rejected")
    void sequenceConstructor_ticketTag_wrongClass_throws() {
        // Arrange: minimal valid fields + tag 3 as CONTEXT-SPECIFIC instead of APPLICATION
        ASN1EncodableVector v = new ASN1EncodableVector();