// int 0x01020304
        doAnswer(inv -> {
            byte[] b = inv.getArgument(0);
            int off = inv.getArgument(1);
            b[off] = 0x01;
            b[off + 1] = 0x02;
            b[off + 2] = 0x03;
            b[off + 3] = 0x04;
            return 4;
        }).when(raf).read(any(byte[].class), anyInt(), eq(4));
        assertEquals(0x01020304, raf.readInt());

                Arguments.of("too short header", new byte[] { 0x04, 0x01, 0x00 }, IllegalArgumentException.class),

                // Wrong TOK_ID
                Arguments.of("wrong TOK_ID", new byte[] { 0x00, 0x02, 0x00, 0x01 }, IllegalArgumentException.class),

                // OID length claims more than available

        when(this.mechContext.getFlags()).thenReturn(0x1234);
        when(this.mechContext.initSecContext(any(byte[].class), eq(0), eq(0))).thenReturn(new byte[] { 0x01, 0x02 });

        // Act: len==0 triggers initial token construction
        byte[] out = ctx.initSecContext(null, 0, 0);

        // Assert: returns a SPNEGO token (opaque here but non-null/non-empty)

        }

        @Test
        @DisplayName("Should reject null data buffer in sign method")
        void testSignNullDataBuffer() {
            assertThrows(IllegalArgumentException.class, () -> digest.sign(null, 0, 100, request, response),
                    "Should throw IllegalArgumentException for null data buffer");
        }

        @Test
        @DisplayName("Should reject negative offset in sign method")

    void testWithVariousAttributeFlags() {
        // Test common file attribute combinations
        int[] attributeFlags = { 0x01, // FILE_ATTRIBUTE_READONLY
                0x02, // FILE_ATTRIBUTE_HIDDEN
                0x04, // FILE_ATTRIBUTE_SYSTEM
                0x10, // FILE_ATTRIBUTE_DIRECTORY
                0x20, // FILE_ATTRIBUTE_ARCHIVE
                0x80, // FILE_ATTRIBUTE_NORMAL

        }

        @Test
        @DisplayName("Should return correct pathConsumed value")
        void testGetPathConsumed() {
            assertEquals(50, buffer.getPathConsumed()); // 100 / 2
        }

        @Test
        @DisplayName("Should return correct numReferrals value")
        void testGetNumReferrals() {
            assertEquals(3, buffer.getNumReferrals());
        }

            response.readBytesWireFormat(buffer, 0);
        });

        assertTrue(exception.getMessage().contains("Invalid negotiate context count: 1000"));
        assertTrue(exception.getMessage().contains("must be 0-100"));
    }

    /**
     * Test validation of negative negotiate context count.
     */
    @Test
    public void testNegativeNegotiateContextCount() {
        byte[] buffer = createBasicNegotiateResponseBuffer();

            byte[] largeBuffer = new byte[1024];

            int encoded = context.encode(largeBuffer, 0);
            assertEquals(2 + 200, encoded); // 2 for count + 100*2 for ciphers

            EncryptionNegotiateContext decoded = new EncryptionNegotiateContext();
            try {
                int decodedSize = decoded.decode(largeBuffer, 0, encoded);

    private String sanitizeForLog(String str) {
        if (str == null) {
            return "null";
        }

        // Truncate long strings
        if (str.length() > 100) {
            str = str.substring(0, 100) + "...";
        }

        // Remove control characters
        return str.replaceAll("[\\x00-\\x1F\\x7F]", "?");
    }

    /**
     * Validation statistics
     */

            throw new RuntimeException("Try setting jcifs.smb1.encoding=US-ASCII", uee);
        }
        int passwordLength = passwordBytes.length;

        // Only encrypt the first 14 bytes of the password for Pre 0.12 NT LM
        if (passwordLength > 14) {
            passwordLength = 14;
        }
        System.arraycopy(passwordBytes, 0, p14, 0, passwordLength);
        E(p14, S8, p21);
        E(p21, challenge, p24);