}
	var (
		sealingKey   [32]byte
		encryptedKey bytes.Buffer
	)
	mac := hmac.New(sha256.New, extKey)
	mac.Write(iv[:])
	mac.Write([]byte(domain))
	mac.Write([]byte(SealAlgorithm))
	mac.Write([]byte(path.Join(bucket, object))) // use path.Join for canonical 'bucket/object'
	mac.Sum(sealingKey[:0])

    void read_oneByteVariants() throws Exception {
        SmbRandomAccessFile raf = spy(newInstance("r", false, false, false));
        // For each 1-byte read, fill provided buffer with 0xFF/0x01
        doAnswer(inv -> {
            byte[] b = inv.getArgument(0);
            int off = inv.getArgument(1);
            b[off] = (byte) 0xFF;
            return 1;

        // For Unicode: 1 byte (initial null in writeBytesWireFormat)
        // + potential 1 byte alignment (in writeString) + fileName.length() * 2 + 2 bytes (terminating nulls)
        // Since headerStart is 0 and dstIndex starts at 1 (after initial null), (1-0)%2=1, so alignment byte added
        // Total: 1 + 1 + 12*2 + 2 = 28 bytes
        byte[] dst = new byte[30]; // Use extra buffer space to avoid index errors

        bufferIndex += 16;

        // Write version major (1 byte)
        buffer[bufferIndex++] = (byte) versionMajor;

        // Write version minor (1 byte)
        buffer[bufferIndex++] = (byte) versionMinor;

        // Write type (4 bytes)
        SMBUtil.writeInt4(serverType, buffer, bufferIndex);
        bufferIndex += 4;

        // Write comment offset (4 bytes)

        // Test Trans2 subcommands
        assertEquals((byte) 0x01, SmbComTransaction.TRANS2_FIND_FIRST2);
        assertEquals((byte) 0x02, SmbComTransaction.TRANS2_FIND_NEXT2);
        assertEquals((byte) 0x03, SmbComTransaction.TRANS2_QUERY_FS_INFORMATION);
        assertEquals((byte) 0x05, SmbComTransaction.TRANS2_QUERY_PATH_INFORMATION);
        assertEquals((byte) 0x10, SmbComTransaction.TRANS2_GET_DFS_REFERRAL);

    }

    @Override
    protected int writeSetupWireFormat(final byte[] dst, final int dstIndex) {
        return 0;
    }

    @Override
    protected int writeParametersWireFormat(final byte[] dst, final int dstIndex) {
        return 0;
    }

    @Override
    protected int writeDataWireFormat(final byte[] dst, final int dstIndex) {
        return 0;
    }

    @Override

     *
     * @see jcifs.BufferCache#getBuffer()
     */
    @Override
    public byte[] getBuffer() {
        synchronized (this.cache) {
            byte[] buf;

            if (this.freeBuffers > 0) {
                for (int i = 0; i < this.cache.length; i++) {
                    if (this.cache[i] != null) {
                        buf = (byte[]) this.cache[i];
                        this.cache[i] = null;

        @Test
        @DisplayName("Should encode at different buffer positions")
        void testEncodeAtDifferentPositions() {
            int[] hashAlgos = { 1, 2 };
            byte[] salt = new byte[8];
            Arrays.fill(salt, (byte) 0xFF);

            context = new PreauthIntegrityNegotiateContext(mockConfig, hashAlgos, salt);

            // Encode at position 100

        String sessionId = "test-session-2";
        byte[] salt = preauthService.generatePreauthSalt();

        preauthService.initializeSession(sessionId, salt, PreauthIntegrityService.HASH_ALGO_SHA512);

        byte[] initialHash = preauthService.getCurrentPreauthHash(sessionId);
        assertNotNull(initialHash);

        // Update with negotiate message
        byte[] negotiateMessage = "SMB2 Negotiate Request".getBytes();

        // Tag [1] IMPLICIT, content is 0x01 0x02 0x03
        byte[] data = new byte[] { (byte) 0xA1, 0x03, 0x01, 0x02, 0x03 };
        ByteArrayInputStream bais = new ByteArrayInputStream(data);
        ASN1InputStream ais = new ASN1InputStream(bais);
        byte[] result = ASN1Util.readUnparsedTagged(1, 10, ais);
        assertArrayEquals(new byte[] { 0x01, 0x02, 0x03 }, result);
    }

    @Test