// Assert
        assertEquals(expectedFlags, queryPolicy.getFlags());
        // Binary check for individual flags
        assertEquals(0x03, queryPolicy.getFlags()); // 0x01 | 0x02 = 0x03
    }

    @Test
    void getOpnum_shouldReturnCorrectValue() {
        // Arrange
        short level = 1;

    class ToStringTests {

        @Test
        @DisplayName("toString with valid data produces expected format")
        void testToStringWithValidData() {
            byte[] challenge = new byte[] { (byte) 0x01, (byte) 0x02, (byte) 0x03, (byte) 0xFF };
            UniAddress dc = mock(UniAddress.class);
            when(dc.toString()).thenReturn("SERVER123");

            NtlmChallenge nc = new NtlmChallenge(challenge, dc);

        // Then
        assertEquals(testType, nameType);
        verify(mockNetbiosName).getNameType();
    }

    @ParameterizedTest
    @ValueSource(ints = { 0x00, 0x03, 0x06, 0x1B, 0x1C, 0x1D, 0x1E, 0x20 })
    @DisplayName("Should handle various NetBIOS name types")
    void testVariousNameTypes(int nameType) {
        // Given
        when(mockNetbiosName.getNameType()).thenReturn(nameType);

        }
        impersonationLevel = 0x02; // As seen on NT :~)
        securityFlags = (byte) 0x03; // SECURITY_CONTEXT_TRACKING | SECURITY_EFFECTIVE_ONLY
    }

    @Override
    int writeParameterWordsWireFormat(final byte[] dst, int dstIndex) {
        final int start = dstIndex;

        dst[dstIndex] = (byte) 0x00;
        dstIndex++;

        SmbComLockingAndX cmd = new SmbComLockingAndX(cfg);
        // set fields via reflection
        setField(cmd, "fid", 0x1234);
        setField(cmd, "typeOfLock", (byte) 0x05);
        setField(cmd, "newOpLockLevel", (byte) 0x01);
        setField(cmd, "timeout", 3000L);
        // arrays of one lock and one unlock range
        LockingAndXRange lock = new LockingAndXRange(false);

            buffer[0] = 0x10;
            buffer[1] = 0x00;
            // Share type (DISK)
            buffer[2] = Smb2TreeConnectResponse.SMB2_SHARE_TYPE_DISK;
            // Reserved
            buffer[3] = 0;
            // Share flags (DFS)
            buffer[4] = 0x01;
            buffer[5] = 0x00;
            buffer[6] = 0x00;
            buffer[7] = 0x00;
            // Capabilities (DFS)

        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        PrintStream ps = new PrintStream(baos);

        // Test with control characters and printable characters
        byte[] data = { 0x00, 0x01, 0x09, 0x0A, 0x0D, 0x1F, // Control characters
                0x20, 0x41, 0x42, 0x7E, // Printable characters
                (byte) 0x7F, (byte) 0x80, (byte) 0xFF // Extended/control
        };

    static final int FILE_SYNCHRONOUS_IO_ALERT = 0x00000010;
    static final int FILE_SYNCHRONOUS_IO_NONALERT = 0x00000020;

    // security flags
    static final int SECURITY_CONTEXT_TRACKING = 0x01;
    static final int SECURITY_EFFECTIVE_ONLY = 0x02;

    private int rootDirectoryFid;

    private final int extFileAttributes;

    private final int shareAccess;

    private int createDisposition;

        }
    }

    /* --- flag handling -------------------------------- */
    @Test
    void testFlagSetAndUnset() {
        TestMessage m = new TestMessage();
        int FLAG_A = 0x01;
        int FLAG_B = 0x02;
        assertFalse(m.isFlagSet(FLAG_A));
        m.setFlag(FLAG_A);
        assertTrue(m.isFlagSet(FLAG_A));
        // unset correctly removes the flag
        m.unsetFlag(FLAG_A);

    void byteArrayConstructor_malformedDER_throwsWrapped() {
        // Arrange: Truncated SEQUENCE (0x30 len=2 but only 1 byte of content)
        byte[] malformed = new byte[] { 0x30, 0x02, 0x01 };

        // Act + Assert
        PACDecodingException ex = assertThrows(PACDecodingException.class, () -> new KerberosApRequest(malformed, null));
        assertTrue(ex.getMessage().contains("Malformed Kerberos Ticket"));