}

    @Test
    @DisplayName("addFlags0 combines flags correctly")
    void addFlags0() {
        SmbComNTCreateAndX req = createRequest(0, 0);
        req.addFlags0(0x10);
        int flags0 = (int) getPrivateField(req, "flags0");
        assertTrue((flags0 & 0x10) != 0, "flag should be set after addFlags0");
        // Calling again should combine rather than overwrite
        req.addFlags0(0x20);

        super(andx);
        this.path = fileName;
        command = SMB_COM_OPEN_ANDX;

        desiredAccess = access & 0x3;
        if (desiredAccess == 0x3) {
            desiredAccess = 0x2; /* Mmm, I thought 0x03 was RDWR */
        }
        desiredAccess |= SHARING_DENY_NONE;
        desiredAccess &= ~0x1; // Win98 doesn't like GENERIC_READ ?! -- get Access Denied.

        // searchAttributes

            originalUuid.clock_seq_hi_and_reserved = (byte) 0x99;
            originalUuid.clock_seq_low = (byte) 0x88;
            originalUuid.node = new byte[] { (byte) 0x11, (byte) 0x22, (byte) 0x33, (byte) 0x44, (byte) 0x55, (byte) 0x66 };

            // Mock encoding buffer
            NdrBuffer encodeBuffer = mock(NdrBuffer.class);
            when(encodeBuffer.derive(anyInt())).thenReturn(encodeBuffer);

        assertEquals("0A0B0C", Hexdump.toHexString(data3, 0, 6)); // 6 chars = 3 bytes

        // Test with offset - NOTE: srcIndex is ignored due to bug, it always starts from index 0
        byte[] data4 = { 0x00, 0x11, 0x22, 0x33, 0x44 };
        assertEquals("00", Hexdump.toHexString(data4, 1, 2)); // Bug: ignores srcIndex, reads from 0
        assertEquals("0011", Hexdump.toHexString(data4, 1, 4)); // Bug: ignores srcIndex, reads from 0

            byte[] testContext =
                    new byte[] { (byte) 0x11, (byte) 0x22, (byte) 0x33, (byte) 0x44, (byte) 0x55, (byte) 0x66, (byte) 0x77, (byte) 0x88 };
            message.setContext(testContext);
            byte[] testTargetInfo = new byte[] { 0x10, 0x20, 0x30 };
            message.setTargetInformation(testTargetInfo);

            // When

        testBuffer[0] = 0x00; // Allow ACE
        testBuffer[1] = 0x03; // FLAGS_OBJECT_INHERIT | FLAGS_CONTAINER_INHERIT
        testBuffer[2] = 0x20; // Size low byte (32)
        testBuffer[3] = 0x00; // Size high byte
        testBuffer[4] = (byte) 0xA9; // Access mask byte 0
        testBuffer[5] = 0x00; // Access mask byte 1
        testBuffer[6] = 0x12; // Access mask byte 2
        testBuffer[7] = 0x00; // Access mask byte 3

        // create a buffer with count = 0x1234 (4660 decimal)
        // Using little-endian byte order as per SMBUtil.readInt2
        byte[] buf = new byte[12];
        buf[0] = 0x34; // Low byte
        buf[1] = 0x12; // High byte
        int written = resp.readParameterWordsWireFormat(buf, 0);

        assertEquals(8, written, "Expected readParameterWordsWireFormat to advance 8 bytes");

        byte[] a = new byte[] { 0x01, 0x02, 0x03 };
        assertThrows(IndexOutOfBoundsException.class, () -\u003e NtlmMessage.readULong(a, 0));
    }

    @Test
    @DisplayName("readSecurityBuffer correctly extracts data")
    void testReadSecurityBuffer() {
        byte[] buf = new byte[8 + 4];
        byte[] payload = { 0x11, 0x22, 0x33, 0x44 };
        NtlmMessage.writeSecurityBuffer(buf, 0, 8, payload);

        super(config, SMB_COM_OPEN_ANDX, fileName, andx);
        this.fileAttributes = fileAttributes;

        this.desiredAccess = access & 0x3;
        if (this.desiredAccess == 0x3) {
            this.desiredAccess = 0x2; /* Mmm, I thought 0x03 was RDWR */
        }

        // map shareAccess as far as we can

        assertEquals(1, SMBUtil.readInt2(buffer, 8));
        assertEquals(1, SMBUtil.readInt2(buffer, 10));
    }

    /**
     * Test that a large file lock (bit 0x10 set) is encoded and decoded correctly.
     */
    @ParameterizedTest
    @ValueSource(ints = { 0x10, 0x11 })
    void largeFileFlagSet_and_decoded_according_to_type(int type) throws Exception {
        Configuration cfg = mock(Configuration.class);