dst[dstIndex + 2 * i + 2] = (byte) ((tmp[i] & 0x0F) + 0x41);
            }
            for (; i < 15; i++) {
                dst[dstIndex + 2 * i + 1] = (byte) 0x43;
                dst[dstIndex + 2 * i + 2] = (byte) 0x41;
            }
            dst[dstIndex + TYPE_OFFSET] = (byte) (((hexCode & 0xF0) >> 4) + 0x41);

        when(this.mechContext.getFlags()).thenReturn(0x1234);
        when(this.mechContext.initSecContext(any(byte[].class), eq(0), eq(0))).thenReturn(new byte[] { 0x01, 0x02 });

        // Act: len==0 triggers initial token construction
        byte[] out = ctx.initSecContext(null, 0, 0);

        // Assert: returns a SPNEGO token (opaque here but non-null/non-empty)

        setPrivateField(response, "commonCapabilities", 0x2F); // 0010 1111

        // Then
        assertTrue(response.haveCapabilitiy(0x01)); // Has this bit
        assertTrue(response.haveCapabilitiy(0x0F)); // Has all these bits
        assertFalse(response.haveCapabilitiy(0x10)); // Doesn't have this bit
        assertFalse(response.haveCapabilitiy(0x40)); // Doesn't have this bit
    }

    @Test

    class ToStringTests {

        @ParameterizedTest
        @DisplayName("Should format command name correctly")
        @ValueSource(shorts = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11,
                0x12 })
        void testToStringCommandNames(short command) {
            testMessage.setCommand(command);

        int[] attributeFlags = { 0x01, // FILE_ATTRIBUTE_READONLY
                0x02, // FILE_ATTRIBUTE_HIDDEN
                0x04, // FILE_ATTRIBUTE_SYSTEM
                0x10, // FILE_ATTRIBUTE_DIRECTORY
                0x20, // FILE_ATTRIBUTE_ARCHIVE
                0x80, // FILE_ATTRIBUTE_NORMAL
                0x100, // FILE_ATTRIBUTE_TEMPORARY
                0x21, // Combination: ARCHIVE | READONLY

        byte[] server = hex("0102030405060708");
        byte[] client = hex("DEADBEEFCAFEBABE");

        // Act
        byte[] a = NtlmUtil.getNTLM2Response(pwdHash, server, client);
        server[7] ^= 0x01; // mutate
        byte[] b = NtlmUtil.getNTLM2Response(pwdHash, server, client);

        // Assert
        assertEquals(24, a.length);

        filter.init(filterConfig);

        // Test NTLM Type 1 message handling
        byte[] type1Message = new byte[] { 0x4E, 0x54, 0x4C, 0x4D, 0x53, 0x53, 0x50, 0x00, 0x01, 0x00, 0x00, 0x00 };
        String authHeader = "NTLM " + new String(org.bouncycastle.util.encoders.Base64.encode(type1Message));

        when(request.getHeader("Authorization")).thenReturn(authHeader);

        assertArrayEquals(expectedDescrBytes, actualDescrBytes);

        // Verify level (0x0001 - 2 bytes)
        int descrEnd = 2 + expectedDescrBytes.length;
        assertEquals(0x01, dst[descrEnd]);
        assertEquals(0x00, dst[descrEnd + 1]);

        // Verify maxDataCount (2 bytes)
        int maxDataCount = SMBUtil.readInt2(dst, descrEnd + 2);
        assertTrue(maxDataCount > 0);

        byte[] der = mech.getDER();
        byte[] nb = name.getBytes();
        int len = 2 + 2 + der.length + 4 + nb.length;
        byte[] out = new byte[len];
        int i = 0;
        out[i++] = 0x04; // TOK_ID[0]
        out[i++] = 0x01; // TOK_ID[1]
        out[i++] = (byte) ((der.length >> 8) & 0xFF);
        out[i++] = (byte) (der.length & 0xFF);
        System.arraycopy(der, 0, out, i, der.length);
        i += der.length;

        // Random but realistic GUID
        byte[] testGuid = { (byte) 0x01, (byte) 0x23, (byte) 0x45, (byte) 0x67, (byte) 0x89, (byte) 0xAB, (byte) 0xCD, (byte) 0xEF,
                (byte) 0xFE, (byte) 0xDC, (byte) 0xBA, (byte) 0x98, (byte) 0x76, (byte) 0x54, (byte) 0x32, (byte) 0x10 };

        // Security mode with signing required