}

        this.state++;
        return out;
    }

    /**
     * Initializes session security keys for signing and sealing.
     * @param mk the master key to derive session keys from
     */
    protected void initSessionSecurity(final byte[] mk) {
        this.signKey = deriveKey(mk, C2S_SIGN_CONSTANT);
        this.verifyKey = deriveKey(mk, S2C_SIGN_CONSTANT);

    logger.get().log(FINER, "closing {0}", this);
    closeables.close();
  }

  private <U extends @Nullable Object> ClosingFuture<U> derive(FluentFuture<U> future) {
    ClosingFuture<U> derived = new ClosingFuture<>(future);
    becomeSubsumedInto(derived.closeables);
    return derived;
  }

  private void becomeSubsumedInto(CloseableList otherCloseables) {
    checkAndUpdateState(OPEN, SUBSUMED);

        assertEquals(name, parsed.toString(), "toString should return the name");
        assertEquals(testOid().hashCode(), parsed.hashCode(), "hashCode should derive from OID");
    }

    @Test
    @DisplayName("Parses empty name length (NAME_LEN=0) as empty string")
    void parseEmptyName() {
        // Arrange
        String name = "";

1a) Send encrypted data key and master key ID to KMS.
1b) Receive decrypted data key.
2)  Decrypt encrypted object key with the KEK derived from the data key.
3a) Receive new plain data key from the KMS using the master key ID of the server config.
3b) Receive encrypted form of the data key from the KMS.
4)  Derive a new KEK from the new data key and re-encrypt the OEK with it.

  /*
   * TODO(cpovirk): It would be great to run all these tests (including class unloading) in an
   * environment that forces Futures.getChecked to its fallback WeakSetValidator. One awful way of
   * doing so would be to derive a separate test library by using remove_from_jar to strip out
   * ClassValueValidator.
   *
   * Fortunately, we get pretty good coverage "by accident": We run all these tests against the

        this.length = 0;
        this.deferred = this;
    }

    /**
     * Creates a derived NdrBuffer at the specified index position.
     *
     * @param idx the index position for the derived buffer
     * @return the derived NdrBuffer
     */
    public NdrBuffer derive(final int idx) {
        final NdrBuffer nb = new NdrBuffer(this.buf, this.start);
        nb.index = idx;

        mockNdrBuffer.deferred = mockDeferredBuffer;

        // Configure mocks for NdrBuffer interactions
        lenient().when(mockDeferredBuffer.derive(anyInt())).thenReturn(mockDeferredBuffer);
        lenient().doNothing().when(mockDeferredBuffer).advance(anyInt());
        // Set up index field for derive operations
        mockDeferredBuffer.index = 0;
    }

    @Nested
    @DisplayName("Protocol Information Tests")

        saltBuffer.putInt(rotationCount); // Rotation counter
        saltBuffer.putInt((int) (System.currentTimeMillis() / 1000)); // Timestamp for additional uniqueness

        // Derive new keys using SMB3 KDF with rotation-specific input
        final int dialectInt = dialect.getDialect();

            assertNull(message.getTargetInformation(), "Target information should be null when no target is set");
        }

        @Test
        @DisplayName("Constructor with CIFSContext and Type1Message should derive flags")
        void testConstructor_CIFSContext_Type1Message() {
            // Given
            CIFSContext mockContext = createMockContext();
            Type1Message type1 = new Type1Message(mockContext);

        byte[] sessionKey = new byte[16];
        byte[] preauthHash = new byte[64];
        new SecureRandom().nextBytes(sessionKey);
        new SecureRandom().nextBytes(preauthHash);

        // Derive initial keys
        int dialectInt = DialectVersion.SMB311.getDialect();
        byte[] encKey = Smb3KeyDerivation.deriveEncryptionKey(dialectInt, sessionKey, preauthHash);