@DisplayName("Test flags2 property")
        void testFlags2Property() {
            testBlock.setFlags2(0x1234);
            assertEquals(0x1234, testBlock.getFlags2());

            testBlock.addFlags2(0x0001);
            assertEquals(0x1235, testBlock.getFlags2());

            testBlock.remFlags2(0x0200);
            assertEquals(0x1035, testBlock.getFlags2());
        }

        @Test

        String expectedDescr = "WrLehDO\u0000B16BBDz\u0000";
        byte[] expectedDescrBytes = expectedDescr.getBytes("ASCII");
        byte[] actualDescrBytes = new byte[expectedDescrBytes.length];
        System.arraycopy(dst, 2, actualDescrBytes, 0, expectedDescrBytes.length);
        assertArrayEquals(expectedDescrBytes, actualDescrBytes);

        // Verify level (0x0001)
        int descrEnd = 2 + expectedDescrBytes.length;

	// have been invented. Pervasive use effectively makes them "official".
	//
	// See http://mdfs.net/Docs/Comp/Archiving/Zip/ExtraField
	zip64ExtraID       = 0x0001 // Zip64 extended information
	ntfsExtraID        = 0x000a // NTFS
	unixExtraID        = 0x000d // UNIX
	extTimeExtraID     = 0x5455 // Extended timestamp
	infoZipUnixExtraID = 0x5855 // Info-ZIP Unix extension
)

// FileHeader describes a file within a ZIP file.

	for i, elt := range e.Elements {
		v, err := elt.evalNode(r, tableAlias)
		if err != nil {
			return nil, err
		}
		res[i] = *v
	}
	return FromArray(res), nil
}

const floatCmpTolerance = 0.000001

func (e *In) evalInNode(r Record, lhs *Value, tableAlias string) (*Value, error) {
	// Compare two values in terms of in-ness.
	var cmp func(a, b Value) bool
	cmp = func(a, b Value) bool {
		// Convert if needed.

        Field commandField = ServerMessageBlock2.class.getDeclaredField("command");
        commandField.setAccessible(true);
        int command = (int) commandField.get(req);
        assertEquals(0x0001, command); // SMB2_SESSION_SETUP command value

        Field securityModeField = Smb2SessionSetupRequest.class.getDeclaredField("securityMode");
        securityModeField.setAccessible(true);

        // Name pointer (0xC00C)
        src[srcIndex] = (byte) 0xC0;
        src[srcIndex + 1] = 0x0C;
        // Record type (NBSTAT = 0x0021)
        src[srcIndex + 2] = 0x00;
        src[srcIndex + 3] = 0x21;
        // Record class (IN = 0x0001)
        src[srcIndex + 4] = 0x00;
        src[srcIndex + 5] = 0x01;
        // TTL (4 bytes)
        src[srcIndex + 6] = 0x00;
        src[srcIndex + 7] = 0x00;

    @JvmField val TLS_RSA_WITH_NULL_MD5 = init("SSL_RSA_WITH_NULL_MD5", 0x0001)

    @JvmField val TLS_RSA_WITH_NULL_SHA = init("SSL_RSA_WITH_NULL_SHA", 0x0002)

    @JvmField val TLS_RSA_EXPORT_WITH_RC4_40_MD5 = init("SSL_RSA_EXPORT_WITH_RC4_40_MD5", 0x0003)

    @JvmField val TLS_RSA_WITH_RC4_128_MD5 = init("SSL_RSA_WITH_RC4_128_MD5", 0x0004)

     */
    public static final int CIPHER_AES_256_CCM = 0x0003;
    /**
     * AES-256-GCM cipher identifier for SMB3.1.1 encryption (future support)
     */
    public static final int CIPHER_AES_256_GCM = 0x0004;

    /**
     * Transform header flag indicating the message is encrypted
     */
    public static final int TRANSFORM_FLAG_ENCRYPTED = 0x0001;

    /**
     * Create encryption context
     *

        case TIME_1601_NANOS_64BE -> {
            t = (date.getTime() + SmbConstants.MILLISECONDS_BETWEEN_1970_AND_1601) * 10000L;
            yield enc_uint64be(t, dst, di);
        }
        case TIME_1601_NANOS_64LE -> {
            t = (date.getTime() + SmbConstants.MILLISECONDS_BETWEEN_1970_AND_1601) * 10000L;
            yield enc_uint64le(t, dst, di);
        }

    // Rate limiting
    private final Map<String, AtomicLong> rateLimitCounters = new ConcurrentHashMap<>();
    private volatile long rateLimitWindow = 60000; // 1 minute
    private volatile int maxEventsPerWindow = 10000; // Increased for tests

    /**
     * Security event types
     */
    public enum EventType {