if err != nil {
			writeSTSErrorResponse(ctx, w, ErrSTSInvalidClientCertificate, err)
			return
		}
	} else {
		// Technically, there is no security argument for verifying the key usage
		// when we don't verify that the certificate has been issued by a trusted CA.
		// Any client can create a certificate with arbitrary key usage settings.
		//
		// However, this check ensures that a certificate with an invalid key usage

        // Verify bytes written
        assertEquals(8, bytesWritten);

        // Verify FID (2 bytes)
        assertEquals(fid, SMBUtil.readInt2(dst, dstIndex));

        // Verify reserved bytes (2 bytes at positions 2-3)
        assertEquals(0x00, dst[dstIndex + 2]);
        assertEquals(0x00, dst[dstIndex + 3]);

        // Verify security information (4 bytes)

            // Verify source offset
            assertEquals(sourceOffset, SMBUtil.readInt8(buffer, startIndex));

            // Verify target offset
            assertEquals(targetOffset, SMBUtil.readInt8(buffer, startIndex + 8));

            // Verify length
            assertEquals(length, SMBUtil.readInt4(buffer, startIndex + 16));

            // Verify reserved bytes are zeros

            // Execute apply goal
            int result = applyGoal.execute(context);

            // Verify success
            assertEquals(0, result, "Apply should succeed");

            // Verify POM was upgraded
            String upgradedPom = Files.readString(pomFile);
            assertTrue(
                    upgradedPom.contains("http://maven.apache.org/POM/4.1.0"),

        // Verify search attributes (masked with 0x37)
        assertEquals(0x37, SMBUtil.readInt2(buffer, 0));

        // Verify max items
        assertEquals(100, SMBUtil.readInt2(buffer, 2));

        // Verify flags (should be 0x00)
        assertEquals(0x00, SMBUtil.readInt2(buffer, 4));

        // Verify information level (SMB_FILE_BOTH_DIRECTORY_INFO)

        int bytesConsumed = response.decode(buffer, 0, 28);

        // Verify
        assertEquals(28, bytesConsumed, "Should consume exactly 28 bytes");

        byte[] resumeKey = response.getResumeKey();
        assertNotNull(resumeKey, "Resume key should not be null");
        assertEquals(24, resumeKey.length, "Resume key should be 24 bytes");

        // Verify resume key content
        for (int i = 0; i < 24; i++) {

        // Verify that the super constructor was called with the correct arguments
        // Note: Mockito cannot directly verify super constructor calls.
        // We assume if the object is created, the super constructor was called.
        // We can verify the state of the object after construction.

        // Verify ptype and flags are set correctly

     * This prevents accidental modification of these critical constants.
     */
    @Test
    void testConstantValues() {
        // Verify the PAC version
        assertEquals(0, PacConstants.PAC_VERSION, "PAC_VERSION should be 0");

        // Verify PAC buffer types
        assertEquals(1, PacConstants.LOGON_INFO, "LOGON_INFO should be 1");

        assertEquals(3, entries.length);

        // Verify disk share
        assertEquals("DiskShare", entries[0].getName());
        assertEquals(8, entries[0].getType()); // TYPE_SHARE

        // Verify printer share
        assertEquals("PrinterShare", entries[1].getName());
        assertEquals(32, entries[1].getType()); // TYPE_PRINTER (0x20)

        // Verify named pipe

        ns.encode(spy);
        // NdrShort passes its value (already masked to 0xFF) to enc_ndr_short
        verify(spy).enc_ndr_short(42);
    }

    /**
     * Verify that decode invokes NdrBuffer.dec_ndr_short.
     */
    @Test
    void decodeWithSpiedBufferCallsDecMethod() throws NdrException {
        NdrShort ns = new NdrShort(0); // value will be overwritten