assertTrue(str.contains("name=test.txt"), "The file name should appear");
        // securityFlags are set to 0x03 – verify hex sequence
        assertTrue(str.contains("securityFlags=0x03"), "securityFlags should be present");
    }

    /**
     * Fetch a private field value via reflection.  This helper keeps the

        assertNotNull(result);
        assertTrue(result.contains("FileNotifyInformation"));
        assertTrue(result.contains("nextEntry=0"));
        assertTrue(result.contains("action=0x0000")); // Hexdump.toHexString produces 4-char padded hex
        assertTrue(result.contains("file=null"));
    }

    @ParameterizedTest
    @DisplayName("Test decode with aligned next entry offsets")

    void testSubcommandConstants() {
        // Test Trans2 subcommands
        assertEquals((byte) 0x01, SmbComTransaction.TRANS2_FIND_FIRST2);
        assertEquals((byte) 0x02, SmbComTransaction.TRANS2_FIND_NEXT2);
        assertEquals((byte) 0x03, SmbComTransaction.TRANS2_QUERY_FS_INFORMATION);
        assertEquals((byte) 0x05, SmbComTransaction.TRANS2_QUERY_PATH_INFORMATION);

            createDisposition = FILE_OPEN;
        }

        if ((createOptions & 0x0001) == 0) {
            this.createOptions = createOptions | 0x0040;
        } else {
            this.createOptions = createOptions;
        }
        impersonationLevel = 0x02; // As seen on NT :~)
        securityFlags = (byte) 0x03; // SECURITY_CONTEXT_TRACKING | SECURITY_EFFECTIVE_ONLY
    }

    @Override

    static final byte TRANS2_FIND_NEXT2 = (byte) 0x02;
    static final byte TRANS2_QUERY_FS_INFORMATION = (byte) 0x03;
    static final byte TRANS2_QUERY_PATH_INFORMATION = (byte) 0x05;
    static final byte TRANS2_GET_DFS_REFERRAL = (byte) 0x10;
    static final byte TRANS2_SET_FILE_INFORMATION = (byte) 0x08;

    static final int NET_SHARE_ENUM = 0x0000;
    static final int NET_SERVER_ENUM2 = 0x0068;

        buffer.put((byte) 0x01); // SubAuthorityCount
        buffer.put(new byte[] { 0, 0, 0, 0, 0, 2 }); // IdentifierAuthority
        buffer.putInt(0); // SubAuthority

        // DACL at offset 60
        buffer.position(60);
        buffer.put((byte) 0x02); // AclRevision
        buffer.put((byte) 0x00); // Padding
        buffer.putShort((short) 8); // AclSize
        buffer.putShort((short) 0); // AceCount

        assertArrayEquals(expectedDescrBytes, actualDescrBytes);

        // Verify level (0x0001)
        int descrEnd = 2 + expectedDescrBytes.length;
        assertEquals(0x01, dst[descrEnd]);
        assertEquals(0x00, dst[descrEnd + 1]);

        // Verify maxDataCount (16384)
        assertEquals(16384, SMBUtil.readInt2(dst, descrEnd + 2));

            this.createDisposition = FILE_OPEN;
        }

        if ((createOptions & 0x0001) == 0) {
            this.createOptions = createOptions | 0x0040;
        } else {
            this.createOptions = createOptions;
        }
        this.impersonationLevel = 0x02; // As seen on NT :~)
        this.securityFlags = (byte) 0x03; // SECURITY_CONTEXT_TRACKING | SECURITY_EFFECTIVE_ONLY
    }

    /**

    <magic priority="50">
      <match value="BM" type="string" offset="0">
        <match value="0x0100" type="string" offset="26">
      	  <match value="0x0000" type="string" offset="28"/>
      	  <match value="0x0100" type="string" offset="28"/>
      	  <match value="0x0400" type="string" offset="28"/>
      	  <match value="0x0800" type="string" offset="28"/>
      	  <match value="0x1000" type="string" offset="28"/>

    private static final int TEST_CAPABILITIES = 0x00000001;
    private static final long TEST_PREVIOUS_SESSION_ID = 0x1234567890ABCDEFL;
    private static final byte[] TEST_TOKEN = { 0x01, 0x02, 0x03, 0x04, 0x05 };

    @BeforeEach
    void setUp() {
        mockConfig = mock(Configuration.class);
        mockContext = mock(CIFSContext.class);
        when(mockContext.getConfig()).thenReturn(mockConfig);