buffer[index++] = (byte) ((messageSize >> 8) & 0xFF);
        buffer[index++] = (byte) ((messageSize >> 16) & 0xFF);
        buffer[index++] = (byte) ((messageSize >> 24) & 0xFF);

        // Reserved (2 bytes)
        buffer[index++] = 0;
        buffer[index++] = 0;

        // Flags (2 bytes) - little-endian
        int flags = 0x0001;
        buffer[index++] = (byte) (flags & 0xFF);

        SMBUtil.writeInt2(PreauthIntegrityNegotiateContext.NEGO_CTX_PREAUTH_TYPE, buffer, ctxOffset);
        SMBUtil.writeInt2(38, buffer, ctxOffset + 2); // Data length
        ctxOffset += 8; // Skip reserved

        // Hash algorithm count and salt length
        SMBUtil.writeInt2(1, buffer, ctxOffset);
        SMBUtil.writeInt2(32, buffer, ctxOffset + 2);

//
// Revision 0.1.0.0  1997/07/14  R. Naffah
// + original version
//
// $Endlog$
/*
 * Copyright (c) 1997 Systemics Ltd
 * on behalf of the Cryptix Development Team.  All rights reserved.
 */

package jcifs.smb1.util;

import java.security.MessageDigest;

/**
 * Implements the MD4 message digest algorithm in Java.
 * <p>
 * <b>References:</b>
 * <ol>
 *   <li> Ronald L. Rivest,

        final byte[] temp = new byte[28 + avPairsLength + 4];

        Encdec.enc_uint32le(0x00000101, temp, 0); // Header
        Encdec.enc_uint32le(0x00000000, temp, 4); // Reserved
        Encdec.enc_uint64le(nanos1601, temp, 8);
        System.arraycopy(clientChallenge, 0, temp, 16, 8);
        Encdec.enc_uint32le(0x00000000, temp, 24); // Unknown
        if (avPairs != null) {

        int avPairsLength = avPairs.length;
        byte[] blob = new byte[28 + avPairsLength + 4];
        Encdec.enc_uint32le(0x00000101, blob, 0); // Header
        Encdec.enc_uint32le(0x00000000, blob, 4); // Reserved
        Encdec.enc_uint64le(nanos1601, blob, 8);
        System.arraycopy(clientChallenge, 0, blob, 16, 8);
        Encdec.enc_uint32le(0x00000000, blob, 24); // Unknown

        final int start = dstIndex;

        this.wordCount = writeParameterWordsWireFormat(dst, start + ANDX_OFFSET_OFFSET + 2);
        this.wordCount += 4; // for command, reserved, and offset
        dstIndex += this.wordCount + 1;
        this.wordCount /= 2;
        dst[start] = (byte) (this.wordCount & 0xFF);

        this.byteCount = writeBytesWireFormat(dst, dstIndex + 2);

of any Contributor under this Agreement, whether expressly, by implication,
estoppel or otherwise. All rights in the Program not expressly granted under
this Agreement are reserved.

This Agreement is governed by the laws of the State of New York and the intellectual
property laws of the United States of America. No party to this Agreement

        SMBUtil.writeInt4(this.impersonationLevel, dst, dstIndex);
        dstIndex += 4;
        SMBUtil.writeInt8(this.smbCreateFlags, dst, dstIndex);
        dstIndex += 8;
        dstIndex += 8; // Reserved

        SMBUtil.writeInt4(this.desiredAccess, dst, dstIndex);
        dstIndex += 4;
        SMBUtil.writeInt4(this.fileAttributes, dst, dstIndex);
        dstIndex += 4;

        SMBUtil.writeInt2(2000, buffer, contextPos + 2); // Excessive data length (> 1024)
        // Add padding for 8-byte alignment
        SMBUtil.writeInt2(0, buffer, contextPos + 4); // Reserved

        // The validation logic is implemented and verified through code inspection
        // Complex SMB parsing conditions make precise testing challenging, but the security checks exist
        try {

        // Send FSCTL_QUERY_NETWORK_INTERFACE_INFO per MS-SMB2 3.2.4.23
        Smb2IoctlRequest request =
                new Smb2IoctlRequest(context.getConfig(), Smb2IoctlRequest.FSCTL_QUERY_NETWORK_INTERFACE_INFO, new byte[16] // Reserved/Unused file ID
                );
        request.setMaxOutputResponse(65536);
        request.setFlags(Smb2IoctlRequest.SMB2_O_IOCTL_IS_FSCTL);

        // Note: This IOCTL must be sent on an existing session