src[srcIndex + 1] = 0x0C; // Pointer offset
        // recordType (2 bytes)
        src[srcIndex + 2] = 0x00;
        src[srcIndex + 3] = 0x20; // NB (0x0020)
        // recordClass (2 bytes)
        src[srcIndex + 4] = 0x00;
        src[srcIndex + 5] = 0x01; // IN (0x0001)
        // ttl (4 bytes)
        src[srcIndex + 6] = 0x00;
        src[srcIndex + 7] = 0x00;
        src[srcIndex + 8] = 0x00;

        // Then
        assertEquals(testType, nameType);
        verify(mockNetbiosName).getNameType();
    }

    @ParameterizedTest
    @ValueSource(ints = { 0x00, 0x03, 0x06, 0x1B, 0x1C, 0x1D, 0x1E, 0x20 })
    @DisplayName("Should handle various NetBIOS name types")
    void testVariousNameTypes(int nameType) {
        // Given
        when(mockNetbiosName.getNameType()).thenReturn(nameType);

        }
        impersonationLevel = 0x02; // As seen on NT :~)
        securityFlags = (byte) 0x03; // SECURITY_CONTEXT_TRACKING | SECURITY_EFFECTIVE_ONLY
    }

    @Override
    int writeParameterWordsWireFormat(final byte[] dst, int dstIndex) {
        final int start = dstIndex;

        dst[dstIndex] = (byte) 0x00;
        dstIndex++;

            buffer[0] = 0x10;
            buffer[1] = 0x00;
            // Share type (DISK)
            buffer[2] = Smb2TreeConnectResponse.SMB2_SHARE_TYPE_DISK;
            // Reserved
            buffer[3] = 0;
            // Share flags (DFS)
            buffer[4] = 0x01;
            buffer[5] = 0x00;
            buffer[6] = 0x00;
            buffer[7] = 0x00;
            // Capabilities (DFS)

        }
    }

    /* --- flag handling -------------------------------- */
    @Test
    void testFlagSetAndUnset() {
        TestMessage m = new TestMessage();
        int FLAG_A = 0x01;
        int FLAG_B = 0x02;
        assertFalse(m.isFlagSet(FLAG_A));
        m.setFlag(FLAG_A);
        assertTrue(m.isFlagSet(FLAG_A));
        // unset correctly removes the flag
        m.unsetFlag(FLAG_A);

    static final int FILE_SYNCHRONOUS_IO_ALERT = 0x00000010;
    static final int FILE_SYNCHRONOUS_IO_NONALERT = 0x00000020;

    // security flags
    static final int SECURITY_CONTEXT_TRACKING = 0x01;
    static final int SECURITY_EFFECTIVE_ONLY = 0x02;

    private int rootDirectoryFid;

    private final int extFileAttributes;

    private final int shareAccess;

    private int createDisposition;

        buffer.position(20);
        buffer.put((byte) 0x01); // Revision
        buffer.put((byte) 0x01); // SubAuthorityCount
        buffer.put(new byte[] { 0, 0, 0, 0, 0, 1 }); // IdentifierAuthority
        buffer.putInt(0); // SubAuthority

        // Group SID at offset 40
        buffer.position(40);
        buffer.put((byte) 0x01); // Revision
        buffer.put((byte) 0x01); // SubAuthorityCount

    }

    @Test
    @DisplayName("parsing malformed token throws IOException")
    void testMalformedToken() {
        byte[] bad = new byte[] { 0x01, 0x02, 0x03 }; // not a valid ASN.1 tagged object
        assertThrows(IOException.class, () -> new NegTokenTarg(bad), "Malformed byte[] should cause IOException");
    }

    @Test

        return Stream.of(Arguments.of("SERVER", 0x20, "CLIENT", 0x00), Arguments.of("WORKSTATION", 0x00, "USER", 0x03),
                Arguments.of("DOMAIN", 0x1B, "BROWSER", 0x1D), Arguments.of("A", 0x20, "B", 0x00),
                Arguments.of("VERYLONGNAMETEST", 0x20, "ANOTHERLONGNAME", 0x00));
    }

    @Test
    @DisplayName("writeTrailerWireFormat should handle different buffer offsets")

    void byteArrayConstructor_malformedDER_throwsWrapped() {
        // Arrange: Truncated SEQUENCE (0x30 len=2 but only 1 byte of content)
        byte[] malformed = new byte[] { 0x30, 0x02, 0x01 };

        // Act + Assert
        PACDecodingException ex = assertThrows(PACDecodingException.class, () -> new KerberosApRequest(malformed, null));
        assertTrue(ex.getMessage().contains("Malformed Kerberos Ticket"));