private byte[] testMacSigningKey;

    @BeforeEach
    void setUp() {
        MockitoAnnotations.openMocks(this);
        testMacSigningKey = new byte[] { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10 };
    }

    @Test
    @DisplayName("Test constructor with MAC signing key and bypass flag")
    void testConstructorWithBypass() {

        // sid (2 bytes)
        buffer[0] = 0x01;
        buffer[1] = 0x00;
        // numEntries (2 bytes)
        buffer[2] = 0x05;
        buffer[3] = 0x00;
        // isEndOfSearch (2 bytes, bit 0 of first byte)
        buffer[4] = 0x01; // end of search = true
        buffer[5] = 0x00;
        // eaErrorOffset (2 bytes)
        buffer[6] = 0x00;
        buffer[7] = 0x00;
        // lastNameOffset (2 bytes)

    /**
     * Test that the constructor correctly initializes with a valid channel binding hash.
     */
    @Test
    void testConstructorWithValidHash() {
        byte[] testHash = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08 };
        AvChannelBindings avChannelBindings = new AvChannelBindings(testHash);

        assertEquals(AvPair.MsvAvChannelBindings, avChannelBindings.getType(), "Type should be MsvAvChannelBindings");

        // Tag [1] IMPLICIT, content is 0x01 0x02 0x03
        byte[] data = new byte[] { (byte) 0xA1, 0x03, 0x01, 0x02, 0x03 };
        ByteArrayInputStream bais = new ByteArrayInputStream(data);
        ASN1InputStream ais = new ASN1InputStream(bais);
        byte[] result = ASN1Util.readUnparsedTagged(1, 10, ais);
        assertArrayEquals(new byte[] { 0x01, 0x02, 0x03 }, result);
    }

    @Test

            ASN1ObjectIdentifier[] mechs = new ASN1ObjectIdentifier[] { OID_KRB, OID_NTLM };
            int flags = NegTokenInit.DELEGATION | NegTokenInit.INTEGRITY;
            byte[] mechToken = new byte[] { 0x01, 0x02, 0x03, 0x04, 0x05 };
            byte[] mic = new byte[] { (byte) 0xAA, (byte) 0xBB, (byte) 0xCC };

            NegTokenInit original = new NegTokenInit(mechs, flags, mechToken, mic);

   * prefix, or when one array is a prefix of the other, treats the shorter array as the lesser. For
   * example, {@code [] < [0x01] < [0x01, 0x80] < [0x01, 0x7F] < [0x02]}. Values are treated as
   * signed.
   *
   * <p>The returned comparator is inconsistent with {@link Object#equals(Object)} (since arrays

        buffer.position(20);
        buffer.put((byte) 0x01); // Revision
        buffer.put((byte) 0x01); // SubAuthorityCount
        buffer.put(new byte[] { 0, 0, 0, 0, 0, 1 }); // IdentifierAuthority
        buffer.putInt(0); // SubAuthority

        // Group SID at offset 40
        buffer.position(40);
        buffer.put((byte) 0x01); // Revision
        buffer.put((byte) 0x01); // SubAuthorityCount

        // State 1: Generate Type 1 message
        context.initSecContext(new byte[0], 0, 0);

        // Create a mock Type 2 message (server challenge)
        byte[] serverChallenge = new byte[] { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08 };
        int type2Flags = NtlmFlags.NTLMSSP_NEGOTIATE_NTLM | NtlmFlags.NTLMSSP_REQUEST_TARGET | NtlmFlags.NTLMSSP_NEGOTIATE_KEY_EXCH
                | NtlmFlags.NTLMSSP_NEGOTIATE_SIGN;

    // ---------------- Static read tests -----------------
    @Test
    @DisplayName("readULong correctly interprets little endian")
    void testReadULong() {
        byte[] a = new byte[] { (byte) 0x01, (byte) 0x02, (byte) 0x03, (byte) 0x04 };
        int result = NtlmMessage.readULong(a, 0);
        assertEquals(0x04030201, result, "ULong should be little‑endian");
    }

    @Test

    public static final int SMB2_LEASE_NONE = 0x00;

    /**
     * Read caching lease (R)
     */
    public static final int SMB2_LEASE_READ_CACHING = 0x01;

    /**
     * Handle caching lease (H)
     */
    public static final int SMB2_LEASE_HANDLE_CACHING = 0x02;

    /**
     * Write caching lease (W)
     */
    public static final int SMB2_LEASE_WRITE_CACHING = 0x04;

    /**