"flags should be DCERPC_FIRST_FRAG | DCERPC_LAST_FRAG");
        // Verify that the super constructor was called with the correct handle.
        // This is implicitly tested by the object being created without error and
        // the fields set by the constructor being correct.
    }

            // Then
            assertEquals(currentTime, lastModified, "Should return correct last modified time");
            assertEquals(currentTime - 1000, lastAccess, "Should return correct last access time");
            assertEquals(currentTime - 2000, createTime, "Should return correct create time");
            assertTrue(createTime <= lastAccess, "Create time should be before or equal to last access");

        Method currentMethod = processHandleClass.getMethod("current");
        Method infoMethod = processHandleClass.getMethod("info");
        Method userMethod = processHandleInfoClass.getMethod("user");
        Method orElseMethod = optionalClass.getMethod("orElse", Object.class);

        Object current = currentMethod.invoke(null);
        Object info = infoMethod.invoke(current);
        Object user = userMethod.invoke(info);

        byte[] src = "Test".getBytes();

        // Test with non-null source array
        int nextOffset = NtlmMessage.writeSecurityBuffer(dest, 0, src);
        assertEquals(4, nextOffset, "Should return correct next offset.");
        assertEquals(src.length, NtlmMessage.readUShort(dest, 0), "Length should be written correctly.");
        assertEquals(src.length, NtlmMessage.readUShort(dest, 2), "Max length should be written correctly.");

        Regressions reports are greatly appreciated during our RC phase and before a final release.
  - type: textarea
    id: current-behavior
    attributes:
      label: Current Behavior
      description: Tell us what happens
    validations:
      required: true
  - type: textarea
    id: expected-behavior
    attributes:
      label: Expected Behavior

Of course, the attackers would not try all this by hand, they would write a program to do it, possibly with thousands or millions of tests per second. And they would get just one extra correct letter at a time.

But doing that, in some minutes or hours the attackers would have guessed the correct username and password, with the "help" of our application, just using the time taken to answer.

#### Fix it with `secrets.compare_digest()` { #fix-it-with-secrets-compare-digest }

        assertTrue(bytesWritten > 0);

        // Verify data is written at correct offset
        assertEquals(3, dst[startOffset]);

        // Verify total parameter count at correct offset
        assertEquals(500, SMBUtil.readInt4(dst, startOffset + 3));

        // Verify total data count at correct offset
        assertEquals(1000, SMBUtil.readInt4(dst, startOffset + 7));
    }

    @Test

        mockPolicyHandle = mock(SamrPolicyHandle.class);
        testServer = "testServer";
        testAccess = 0x02000000; // SAM_SERVER_CONNECT access right
    }

    @Test
    @DisplayName("Should construct with correct parameters")
    void constructorShouldInitializeFieldsCorrectly() {
        // When
        MsrpcSamrConnect2 msrpcSamrConnect2 = new MsrpcSamrConnect2(testServer, testAccess, mockPolicyHandle);

        // Then

    }

    /**
     * Test method for {@link jcifs.pac.PacSidAttributes#getAttributes()}.
     */
    @Test
    void testGetAttributes() {
        // Test the getAttributes method
        assertEquals(attributes, pacSidAttributes.getAttributes(), "getAttributes should return the correct attributes.");
    }

    }

    /**
     * Test getInitialSize() returns the correct size.
     */
    @Test
    void testGetInitialSize() {
        long expectedSize = 1024L;
        when(smbFileHandle.getInitialSize()).thenReturn(expectedSize);
        long actualSize = smbFileHandle.getInitialSize();
        assertEquals(expectedSize, actualSize, "getInitialSize should return the correct initial file size.");