message.encode(mockBuffer);

            // Verify key operations happened
            verify(mockBuffer).enc_ndr_small(5); // RPC version
            verify(mockBuffer).enc_ndr_long(0x00000010); // Little-endian / ASCII / IEEE
            verify(mockBuffer).enc_ndr_long(message.call_id);
            verify(mockBuffer).enc_ndr_short(message.getOpnum()); // opnum

        assertNotNull(out);
        assertTrue(out.length > 0);

        // Verify interactions: flags and an empty optimistic token are used
        verify(this.mechContext, times(1)).getFlags();
        ArgumentCaptor<byte[]> cap = ArgumentCaptor.forClass(byte[].class);
        verify(this.mechContext, times(1)).initSecContext(cap.capture(), eq(0), eq(0));

        authenticator.resolveCredential(resolver);

        // Verify
        assertTrue(authenticator.isResolverCalled());
        assertNotNull(authenticator.getLastResolver());
    }

    @Test
    public void test_resolveCredential_withNullResolver() {
        // Execute
        authenticator.resolveCredential(null);

        // Verify
        assertTrue(authenticator.isResolverCalled());

    void testConstructorInitialization() {
        // Verify level is set to 200 for DFS root enumeration
        assertEquals(200, dfsRootEnum.level);

        // Verify DCE/RPC message properties
        assertEquals(0, dfsRootEnum.getPtype());
        assertEquals(DcerpcConstants.DCERPC_FIRST_FRAG | DcerpcConstants.DCERPC_LAST_FRAG, dfsRootEnum.getFlags());

        // Verify DFS enumeration structure
        assertNotNull(dfsRootEnum.info);

        // Verify filter interactions: not called for '.' and '..', called for others
        verify(nameFilter, never()).accept(parent, ".");
        verify(nameFilter, never()).accept(parent, "..");
        ArgumentCaptor<String> nameCaptor = ArgumentCaptor.forClass(String.class);
        verify(nameFilter, atLeast(1)).accept(eq(parent), nameCaptor.capture());

        assertEquals(8, bytesWritten);

        // Verify completion filter (4 bytes)
        assertEquals(completionFilter, SMBUtil.readInt4(dst, dstIndex));

        // Verify FID (2 bytes)
        assertEquals(fid, SMBUtil.readInt2(dst, dstIndex + 4));

        // Verify watchTree flag (1 byte)
        assertEquals(0x00, dst[dstIndex + 6]);

        // Verify reserved byte (1 byte)

            mockedNtlmAuthenticator.verify(NtlmAuthenticator::getDefault);
            mockedNtlmAuthenticator.verify(
                    () -> NtlmAuthenticator.requestNtlmPasswordAuthentication(eq(mockNtlmAuthenticator), eq("locationHint"), eq(null)));
            verify(mockRenewableCredentials, never()).renew(); // Ensure renewable path was not taken
        }
    }

        // Act
        handle.close();

        // Assert
        // Verify sendrecv was called once for open and once for close
        verify(mockDcerpcHandle, times(1)).sendrecv(any(MsrpcLsarOpenPolicy2.class));
        verify(mockDcerpcHandle, times(1)).sendrecv(any(MsrpcLsarClose.class));
    }

    @Test

        // Verify bytes written
        assertEquals(24, written);

        // Verify structure size (should be 24)
        assertEquals(24, SMBUtil.readInt2(buffer, offset));

        // Verify close flags (2 bytes at offset+2, should be 0 by default)
        assertEquals(0, SMBUtil.readInt2(buffer, offset + 2));

        // Verify Reserved (4 bytes at offset+4, should be 0)

        filter.doFilter(request, response, filterChain);

        verify(response).setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        verify(response).setHeader("WWW-Authenticate", "NTLM");
        verify(response).addHeader("WWW-Authenticate", "Basic realm=\"TestRealm\"");
        verify(filterChain, never()).doFilter(any(), any());
    }

    @Test