// Owner SID with 3 sub-authorities (S-1-5-21-X-Y-Z)
        testBuffer[20] = 0x01; // revision
        testBuffer[21] = 0x03; // sub-authority count
        testBuffer[22] = 0x00; // identifier authority
        testBuffer[23] = 0x00;
        testBuffer[24] = 0x00;
        testBuffer[25] = 0x00;
        testBuffer[26] = 0x00;
        testBuffer[27] = 0x05;
        SMBUtil.writeInt4(21, testBuffer, 28); // sub-authority 1

            ASN1ObjectIdentifier[] mechs = new ASN1ObjectIdentifier[] { OID_KRB, OID_NTLM };
            int flags = NegTokenInit.DELEGATION | NegTokenInit.INTEGRITY;
            byte[] mechToken = new byte[] { 0x01, 0x02, 0x03, 0x04, 0x05 };
            byte[] mic = new byte[] { (byte) 0xAA, (byte) 0xBB, (byte) 0xCC };

            NegTokenInit original = new NegTokenInit(mechs, flags, mechToken, mic);

        byte[] rawBytes = new byte[] { 0x01, 0x02, 0x03, 0x04 }; // Represents 0x04030201 (little-endian)
        AvFlags avFlags = new AvFlags(rawBytes);
        assertNotNull(avFlags, "AvFlags object should not be null");
        assertEquals(0x04030201, avFlags.getFlags(), "Flags should match the raw bytes (little-endian)");

        // Test with zero
        byte[] zeroBytes = new byte[] { 0x00, 0x00, 0x00, 0x00 };

                // Wrong TOK_ID
                Arguments.of("wrong TOK_ID", new byte[] { 0x00, 0x02, 0x00, 0x01 }, IllegalArgumentException.class),

                // OID length claims more than available
                Arguments.of("oid length exceeds buffer", new byte[] { 0x04, 0x01, 0x00, 0x10, 0x06 }, IllegalArgumentException.class),

    // flags (not the same as flags constructor argument)
    static final int FLAGS_RETURN_ADDITIONAL_INFO = 0x01;
    static final int FLAGS_REQUEST_OPLOCK = 0x02;
    static final int FLAGS_REQUEST_BATCH_OPLOCK = 0x04;

    // Access Mode Encoding for desiredAccess
    static final int SHARING_COMPATIBILITY = 0x00;
    static final int SHARING_DENY_READ_WRITE_EXECUTE = 0x10;
    static final int SHARING_DENY_WRITE = 0x20;

    private Smb2SessionSetupRequest request;

    // Test constants
    private static final int TEST_SECURITY_MODE = 0x01;
    private static final int TEST_CAPABILITIES = 0x00000001;
    private static final long TEST_PREVIOUS_SESSION_ID = 0x1234567890ABCDEFL;
    private static final byte[] TEST_TOKEN = { 0x01, 0x02, 0x03, 0x04, 0x05 };

    @BeforeEach
    void setUp() {
        mockConfig = mock(Configuration.class);

        assertEquals((byte) (0x80 | (NameServicePacket.QUERY << 3) | 0x04 | 0x02 | 0x01), dst[2]); // flags1
        assertEquals((byte) (0x80 | 0x10 | NameServicePacket.FMT_ERR), dst[3]); // flags2
        assertEquals((byte) 0x00, dst[4]); // questionCount
        assertEquals((byte) 0x01, dst[5]);
        assertEquals((byte) 0x00, dst[6]); // answerCount
        assertEquals((byte) 0x02, dst[7]);

    }

    /**
     * Test constructor with a malformed ASN.1 token.
     */
    @Test
    void testConstructor_MalformedToken() {
        // 1. GIVEN
        byte[] malformedToken = new byte[] { 0x00, 0x01, 0x02, 0x03 }; // Not a valid ASN.1 sequence
        Map<Integer, KerberosKey> keys = new HashMap<>();

        // 2. WHEN & 3. THEN
        PACDecodingException exception = assertThrows(PACDecodingException.class, () -> {

    // ---------------- Static read tests -----------------
    @Test
    @DisplayName("readULong correctly interprets little endian")
    void testReadULong() {
        byte[] a = new byte[] { (byte) 0x01, (byte) 0x02, (byte) 0x03, (byte) 0x04 };
        int result = NtlmMessage.readULong(a, 0);
        assertEquals(0x04030201, result, "ULong should be little‑endian");
    }

    @Test

        // Assert
        assertEquals(expectedFlags, queryPolicy.getFlags());
        // Binary check for individual flags
        assertEquals(0x03, queryPolicy.getFlags()); // 0x01 | 0x02 = 0x03
    }

    @Test
    void getOpnum_shouldReturnCorrectValue() {
        // Arrange
        short level = 1;