SMBUtil.writeInt2(dataOffset, buffer, bufferIndex + 2);
        // Set buffer length
        SMBUtil.writeInt4(104, buffer, bufferIndex + 4); // Minimal FileBothDirectoryInfo

        response = spy(response);
        when(response.getHeaderStart()).thenReturn(0);

        // Write minimal FileBothDirectoryInfo at dataOffset
        // NextEntryOffset (0 = last entry)
        SMBUtil.writeInt4(0, buffer, dataOffset);

        // Setup mock ShareInfo502 with a minimal valid security descriptor
        srvsvc.ShareInfo502 info502 = new srvsvc.ShareInfo502();
        // Create a minimal valid security descriptor binary
        // Format: revision(1) + sbz1(1) + control(2) + ownerOffset(4) + groupOffset(4) + saclOffset(4) + daclOffset(4) = 20 bytes minimum
        byte[] securityDescriptorBytes = new byte[20];

            // These methods do not throw and allow interaction checks.
            tc.getConfig();
            tc.getCredentials();

            // Minimal behavior: return a mock SSPContext with lenient stubbing
            SSPContext ctx = mock(SSPContext.class);
            lenient().when(ctx.isEstablished()).thenReturn(false);
            return ctx;
        }

 * method contract.  The tests focus on public API behaviour and the
 * parsing logic in {@code readParameterWordsWireFormat} and
 * {@code readBytesWireFormat}.
 */
public class SmbComTransactionResponseTest {
    /** A minimal concrete subclass for testing */
    private static class DummyResponse extends SmbComTransactionResponse {
        DummyResponse() {
            super();
        }

        // Expose protected/private fields for testing

class Kerb5AuthenticatorTest {

    @Mock
    CIFSContext tc;

    @Mock
    Configuration config;

    private static byte[] spnegoInitWithMechs(ASN1ObjectIdentifier... mechs) {
        // Build a minimal SPNEGO NegTokenInit containing the provided mechanisms
        NegTokenInit tok = new NegTokenInit(mechs, 0, null, null);
        return tok.toByteArray();
    }

    @Test

            double minTime = Math.min(Math.min(timeStart, timeMiddle), timeEnd);
            double timingRatio = (maxTime - minTime) / maxTime;

            // Timing differences should be minimal (within tolerance)
            assertTrue(timingRatio < TIMING_TOLERANCE,
                    String.format(
                            "Timing attack vulnerability detected: timing ratio %.3f exceeds tolerance %.3f "

        assertDoesNotThrow(() -> filter.init(filterConfig));
    }

    @Test
    void testInit_withMinimalConfig() throws ServletException {
        // Test initialization with minimal configuration
        Map<String, String> initParams = new HashMap<>();
        initParams.put("jcifs.smb.client.domain", "MINIMAL_DOMAIN");

    }

    @Test
    @DisplayName("Test readDataWireFormat with valid security descriptor")
    void testReadDataWireFormatWithValidSecurityDescriptor() throws Exception {
        // Create a minimal valid security descriptor buffer
        byte[] buffer = createValidSecurityDescriptorBuffer();

        // Set error code to 0
        setErrorCode(response, 0);

        // Configuration is not used during decode when no signing digest is set
        Configuration cfg = mock(Configuration.class);
        return new Smb2SessionSetupResponse(cfg);
    }

    /**
     * Build a minimal SMB2 header for a response at the given offset.
     * The header is prepared as a synchronous response with server-to-redirector flag.
     */

    @ValueSource(strings = { "", " ", "*", "?" })
    @DisplayName("Supports various wildcard values without throwing (edge cases)")
    void wildcardEdgeCases(String wildcard) throws Exception {
        // minimal successful first response with a single entry
        when(tree.send(any(Trans2FindFirst2.class), any(Trans2FindFirst2Response.class))).thenAnswer((InvocationOnMock inv) -> {