}

    /**
     * Test constructor with a malformed ASN.1 token.
     */
    @Test
    void testConstructor_MalformedToken() {
        // 1. GIVEN
        byte[] malformedToken = new byte[] { 0x00, 0x01, 0x02, 0x03 }; // Not a valid ASN.1 sequence
        Map<Integer, KerberosKey> keys = new HashMap<>();

        // 2. WHEN & 3. THEN
        PACDecodingException exception = assertThrows(PACDecodingException.class, () -> {

    // session service error codes
    /** Connection refused by the remote host */
    public static final int CONNECTION_REFUSED = -1;
    /** Not listening on the called name */
    public static final int NOT_LISTENING_CALLED = 0x80;
    /** Not listening for the calling name */
    public static final int NOT_LISTENING_CALLING = 0x81;
    /** Called name not present */
    public static final int CALLED_NOT_PRESENT = 0x82;

        assertEquals(8, getFieldValue(netServerEnum2, "maxParameterCount"));
        assertEquals(16384, getFieldValue(netServerEnum2, "maxDataCount"));
        assertEquals((byte) 0x00, getFieldValue(netServerEnum2, "maxSetupCount"));
        assertEquals(0, getFieldValue(netServerEnum2, "setupCount"));
        assertEquals(5000, getFieldValue(netServerEnum2, "timeout"));
    }

    @Test

        void setup() throws GeneralSecurityException {
            digest = new Smb2SigningDigest(sessionKey, Smb2Constants.SMB2_DIALECT_0202, null);
            data = new byte[128];
            Arrays.fill(data, (byte) 0x00);

            // Set up mock messages
            request = mock(CommonServerMessageBlock.class);
            response = mock(CommonServerMessageBlock.class);
        }

        @Test

            System.arraycopy(buffer, tokenOffset, actualToken, 0, tokenSize);
            assertArrayEquals(token, actualToken);
        }
    }

    @ParameterizedTest
    @CsvSource({ "0x00, 0x00000000", "0x01, 0x00000001", "0x03, 0x0000000F", "0xFF, 0x7FFFFFFF" })
    @DisplayName("Should handle various security modes and capabilities")

      // Verify that high byte of the 64 bit identifier is zero, modulo
      // the U/L and G bits, with which we are not concerned.
      return false;
    }

    return (bytes[9] == (byte) 0x00) && (bytes[10] == (byte) 0x5e) && (bytes[11] == (byte) 0xfe);
  }

  /**
   * Returns the IPv4 address embedded in an ISATAP address.
   *

        when(response.getHeaderStart()).thenReturn(0);

        // Write minimal SecurityDescriptor header (20 bytes)
        buffer[20] = 1; // Revision
        buffer[21] = 0; // Sbz1
        SMBUtil.writeInt2(0x8004, buffer, 22); // Control flags
        SMBUtil.writeInt4(0, buffer, 24); // Owner offset
        SMBUtil.writeInt4(0, buffer, 28); // Group offset
        SMBUtil.writeInt4(0, buffer, 32); // SACL offset

    }

    @Override
    public final boolean readBoolean() throws SmbException {
        if (read(tmp, 0, 1) < 0) {
            throw new SmbException("EOF");
        }
        return tmp[0] != (byte) 0x00;
    }

    @Override
    public final byte readByte() throws SmbException {
        if (read(tmp, 0, 1) < 0) {
            throw new SmbException("EOF");
        }
        return tmp[0];
    }

        SMBUtil.writeInt2(9, buf, bodyStart);
        buf[bodyStart + 2] = 0x02; // errorContextCount
        buf[bodyStart + 3] = 0x00; // reserved
        int bc = 4;
        SMBUtil.writeInt4(bc, buf, bodyStart + 4);
        byte[] err = new byte[] { 0x55, 0x66, 0x77, 0x01 };
        System.arraycopy(err, 0, buf, bodyStart + 8, bc);

        ASN1ObjectIdentifier[] mechs = new ASN1ObjectIdentifier[] { OID_KRB_LEGACY };
        int flags = NegTokenInit.REPLAY_DETECTION | NegTokenInit.SEQUENCE_CHECKING;
        byte[] mic = new byte[] { 0x00, 0x0A, (byte) 0xFF };

        NegTokenInit init = new NegTokenInit(mechs, flags, null, mic);
        String s = init.toString();

        assertTrue(s.contains("flags=" + flags), "toString should include flags");