void byteArrayConstructor_malformedDER_throwsWrapped() {
        // Arrange: Truncated SEQUENCE (0x30 len=2 but only 1 byte of content)
        byte[] malformed = new byte[] { 0x30, 0x02, 0x01 };

        // Act + Assert
        PACDecodingException ex = assertThrows(PACDecodingException.class, () -> new KerberosApRequest(malformed, null));
        assertTrue(ex.getMessage().contains("Malformed Kerberos Ticket"));

     * This operation releases resources associated with the handle.
     */
    public static class SamrCloseHandle extends DcerpcMessage {

        @Override
        public int getOpnum() {
            return 0x01;
        }

        /** The return value of the operation */
        public int retval;
        /** The handle to be closed */
        public rpc.policy_handle handle;

        /**

     * This operation releases resources associated with the handle.
     */
    public static class SamrCloseHandle extends DcerpcMessage {

        @Override
        public int getOpnum() {
            return 0x01;
        }

        /** The return value of the operation */
        public int retval;
        /** The handle to be closed */
        public rpc.policy_handle handle;

        /**

        }

        @Test
        @DisplayName("Encryption capability should be 0x40")
        void testGlobalCapEncryption() {
            assertEquals(0x40, Smb2Constants.SMB2_GLOBAL_CAP_ENCRYPTION, "Encryption capability must be 0x40");
        }

        @Test
        @DisplayName("All capability flags should be unique powers of 2")

    override val rangeStart: Int,
    val codepointDelta: Int,
  ) : MappedRange {
    private val absoluteDelta = abs(codepointDelta)

    val b1: Int
      get() =
        when {
          codepointDelta < 0 -> 0x40 or (absoluteDelta shr 14)
          codepointDelta > 0 -> 0x50 or (absoluteDelta shr 14)
          else -> error("Unexpected codepointDelta of 0")
        }

    val b2: Int
      get() = absoluteDelta shr 7 and 0x7f

    /**
     * No lease caching
     */
    public static final int SMB2_LEASE_NONE = 0x00;

    /**
     * Read caching lease (R)
     */
    public static final int SMB2_LEASE_READ_CACHING = 0x01;

    /**
     * Handle caching lease (H)
     */
    public static final int SMB2_LEASE_HANDLE_CACHING = 0x02;

    /**
     * Write caching lease (W)
     */

        // Simulate address = 192.168.1.1 (0xC0A80101)
        src[srcIndex + 2] = (byte) 0xC0;
        src[srcIndex + 3] = (byte) 0xA8;
        src[srcIndex + 4] = (byte) 0x01;
        src[srcIndex + 5] = (byte) 0x01;

        // Set 'addrEntry' and 'addrIndex' fields in superclass for the response to be stored
        Field addrEntryField = NameServicePacket.class.getDeclaredField("addrEntry");

        when(cfg.isTraceResourceUsage()).thenReturn(false);
        stubValidTree(1L, true, true);

        byte[] fidBytes = new byte[] { 0x01, 0x02 };
        SmbFileHandleImpl h1 = new SmbFileHandleImpl(cfg, fidBytes, tree, "//u/one", 0x10, 0x20, 0x30, 0x40, 0L);
        String s1 = h1.toString();
        assertTrue(s1.contains("//u/one"));
        assertTrue(s1.contains("0102"), "Expected hex fileId in string");

        }
    }

    /* --- flag handling -------------------------------- */
    @Test
    void testFlagSetAndUnset() {
        TestMessage m = new TestMessage();
        int FLAG_A = 0x01;
        int FLAG_B = 0x02;
        assertFalse(m.isFlagSet(FLAG_A));
        m.setFlag(FLAG_A);
        assertTrue(m.isFlagSet(FLAG_A));
        // unset correctly removes the flag
        m.unsetFlag(FLAG_A);

        // Write READ response body
        int dataLength = 20;
        int dataRemaining = 0;
        int dataOffsetFromHeader = 80;

        // Structure size (17 = 0x11)
        SMBUtil.writeInt2(17, buffer, bodyStart);
        // Data offset (byte - offset from header start)
        buffer[bodyStart + 2] = (byte) dataOffsetFromHeader;
        // Reserved