filter.init(filterConfig);

        // Test NTLM Type 1 message handling
        byte[] type1Message = new byte[] { 0x4E, 0x54, 0x4C, 0x4D, 0x53, 0x53, 0x50, 0x00, 0x01, 0x00, 0x00, 0x00 };
        String authHeader = "NTLM " + new String(org.bouncycastle.util.encoders.Base64.encode(type1Message));

        when(request.getHeader("Authorization")).thenReturn(authHeader);

    void byteArrayConstructor_malformedDER_throwsWrapped() {
        // Arrange: Truncated SEQUENCE (0x30 len=2 but only 1 byte of content)
        byte[] malformed = new byte[] { 0x30, 0x02, 0x01 };

        // Act + Assert
        PACDecodingException ex = assertThrows(PACDecodingException.class, () -> new KerberosApRequest(malformed, null));

            int off = inv.getArgument(1);
            b[off] = 0x3F;
            b[off + 1] = (byte) 0xF0;
            b[off + 2] = 0x00;
            b[off + 3] = 0x00;
            b[off + 4] = 0x00;
            b[off + 5] = 0x00;
            b[off + 6] = 0x00;
            b[off + 7] = 0x00;
            return 8;
        }).when(raf).read(any(byte[].class), anyInt(), eq(8));

            buffer[0] = 0x10;
            buffer[1] = 0x00;
            // Share type (DISK)
            buffer[2] = Smb2TreeConnectResponse.SMB2_SHARE_TYPE_DISK;
            // Reserved
            buffer[3] = 0;
            // Share flags (DFS)
            buffer[4] = 0x01;
            buffer[5] = 0x00;
            buffer[6] = 0x00;
            buffer[7] = 0x00;
            // Capabilities (DFS)

     */
    public static final int FILE_SYNCHRONOUS_IO_ALERT = 0x10;
    /**
     * All operations on the file are performed synchronously without alerts
     */
    public static final int FILE_SYNCHRONOUS_IO_NONALERT = 0x20;
    /**
     * File being created or opened must not be a directory
     */
    public static final int FILE_NON_DIRECTORY_FILE = 0x40;
    /**

            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // NextCommand
            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // MessageId
            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // Reserved / AsyncId
            (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00, // TreeId / AsyncId

    public static final int FLAGS_INHERIT_ONLY = 0x08;
    /** Inheritance flag: ACE was inherited from parent */
    public static final int FLAGS_INHERITED = 0x10;

    boolean allow;
    int flags;
    int access;
    SID sid;

    /**
     * Returns true if this ACE is an allow ACE and false if it is a deny ACE.

        buffer[38] = 0x00;

        // Parameter count (2 bytes)
        buffer[39] = 0x00;
        buffer[40] = 0x00;

        // Parameter offset (2 bytes)
        buffer[41] = 0x00;
        buffer[42] = 0x00;

        // Parameter displacement (2 bytes)
        buffer[43] = 0x00;
        buffer[44] = 0x00;

        // Data count (2 bytes)
        buffer[45] = 0x00;
        buffer[46] = 0x00;

              new byte[] {(byte) 0xcd, (byte) 0xab, (byte) 0x00, (byte) 0x00},
              0x0000abcd,
              null,
              "cdab0000"),
          new ExpectedHashCode(
              new byte[] {
                (byte) 0xef, (byte) 0xcd, (byte) 0xab, (byte) 0x00,
                (byte) 0x00, (byte) 0x00, (byte) 0x00, (byte) 0x00
              },
              0x00abcdef,
              0x0000000000abcdefL,

          char c3 = input.charAt(i + 3);
          if (c0 < 0x80 && c1 < 0x80 && c2 < 0x80 && c3 < 0x80) {
            update(4, c0 | (c1 << 8) | (c2 << 16) | (c3 << 24));
            i += 4;
          } else {
            break;
          }
        }

        for (; i < utf16Length; i++) {
          char c = input.charAt(i);
          if (c < 0x80) {
            update(1, c);
          } else if (c < 0x800) {