// Tag [1] IMPLICIT, content is 0x01 0x02 0x03
        byte[] data = new byte[] { (byte) 0xA1, 0x03, 0x01, 0x02, 0x03 };
        ByteArrayInputStream bais = new ByteArrayInputStream(data);
        ASN1InputStream ais = new ASN1InputStream(bais);
        byte[] result = ASN1Util.readUnparsedTagged(1, 10, ais);
        assertArrayEquals(new byte[] { 0x01, 0x02, 0x03 }, result);
    }

    @Test

        byte[] rawBytes = new byte[] { 0x01, 0x02, 0x03, 0x04 }; // Represents 0x04030201 (little-endian)
        AvFlags avFlags = new AvFlags(rawBytes);
        assertNotNull(avFlags, "AvFlags object should not be null");
        assertEquals(0x04030201, avFlags.getFlags(), "Flags should match the raw bytes (little-endian)");

        // Test with zero
        byte[] zeroBytes = new byte[] { 0x00, 0x00, 0x00, 0x00 };

        // Assert
        assertEquals(expectedFlags, queryPolicy.getFlags());
        // Binary check for individual flags
        assertEquals(0x03, queryPolicy.getFlags()); // 0x01 | 0x02 = 0x03
    }

    @Test
    void getOpnum_shouldReturnCorrectValue() {
        // Arrange
        short level = 1;

    }

    @Override
    protected int readParameterWordsWireFormat(final byte[] buffer, int bufferIndex) {
        final int start = bufferIndex;
        this.isLoggedInAsGuest = ((buffer[bufferIndex] & 0x01) == 0x01) == true;
        bufferIndex += 2;
        if (this.isExtendedSecurity()) {
            final int blobLength = SMBUtil.readInt2(buffer, bufferIndex);
            bufferIndex += 2;

        buffer.position(20);
        buffer.put((byte) 0x01); // Revision
        buffer.put((byte) 0x01); // SubAuthorityCount
        buffer.put(new byte[] { 0, 0, 0, 0, 0, 1 }); // IdentifierAuthority
        buffer.putInt(0); // SubAuthority

        // Group SID at offset 40
        buffer.position(40);
        buffer.put((byte) 0x01); // Revision
        buffer.put((byte) 0x01); // SubAuthorityCount

            bufferIndex += 2;
        }
        this.setNumEntries(SMBUtil.readInt2(buffer, bufferIndex));
        bufferIndex += 2;
        this.isEndOfSearch = ((buffer[bufferIndex] & 0x01) == 0x01) == true;
        bufferIndex += 2;
        this.eaErrorOffset = SMBUtil.readInt2(buffer, bufferIndex);
        bufferIndex += 2;
        this.lastNameOffset = SMBUtil.readInt2(buffer, bufferIndex);

    void byteArrayConstructor_malformedDER_throwsWrapped() {
        // Arrange: Truncated SEQUENCE (0x30 len=2 but only 1 byte of content)
        byte[] malformed = new byte[] { 0x30, 0x02, 0x01 };

        // Act + Assert
        PACDecodingException ex = assertThrows(PACDecodingException.class, () -> new KerberosApRequest(malformed, null));
        assertTrue(ex.getMessage().contains("Malformed Kerberos Ticket"));

    class ToStringTests {

        @Test
        @DisplayName("toString with valid data produces expected format")
        void testToStringWithValidData() {
            byte[] challenge = new byte[] { (byte) 0x01, (byte) 0x02, (byte) 0x03, (byte) 0xFF };
            UniAddress dc = mock(UniAddress.class);
            when(dc.toString()).thenReturn("SERVER123");

            NtlmChallenge nc = new NtlmChallenge(challenge, dc);

        // State 1: Generate Type 1 message
        context.initSecContext(new byte[0], 0, 0);

        // Create a mock Type 2 message (server challenge)
        byte[] serverChallenge = new byte[] { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08 };
        int type2Flags = NtlmFlags.NTLMSSP_NEGOTIATE_NTLM | NtlmFlags.NTLMSSP_REQUEST_TARGET | NtlmFlags.NTLMSSP_NEGOTIATE_KEY_EXCH
                | NtlmFlags.NTLMSSP_NEGOTIATE_SIGN;

        assertEquals((byte) 0x04, dst[4]);
        assertEquals((byte) 0x01, dst[5]);

        // resumeKey (4 bytes, LE)
        assertEquals((byte) 0xEF, dst[6]);
        assertEquals((byte) 0xCD, dst[7]);
        assertEquals((byte) 0xAB, dst[8]);
        assertEquals((byte) 0x89, dst[9]);

        // flags (2 bytes, LE) -> 0x0000
        assertEquals((byte) 0x00, dst[10]);