assertEquals(34, bytesRead);

        // Assert that the serverData fields are populated correctly
        assertEquals(0, response.dialectIndex);
        assertEquals(0x0F, serverData.securityMode);
        assertEquals(0x01, serverData.security);
        assertTrue(serverData.encryptedPasswords);
        assertTrue(serverData.signaturesEnabled);
        assertTrue(serverData.signaturesRequired);

        int bodyStart = headerStart + Smb2Constants.SMB2_HEADER_LENGTH;
        // Error response structure: size(2)=9, errorContextCount(1), reserved(1), bc(4), errorData(bc)
        SMBUtil.writeInt2(9, buf, bodyStart);
        buf[bodyStart + 2] = 0x02; // errorContextCount
        buf[bodyStart + 3] = 0x00; // reserved
        int bc = 4;

            dst[dstIndex] = (byte) 0x01;
        }
        dstIndex++;
        writeInt2(length, dst, dstIndex);
        return HEADER_LENGTH;
    }

    int readHeaderWireFormat(final InputStream in, final byte[] buffer, int bufferIndex) throws IOException {
        type = buffer[bufferIndex] & 0xFF;
        bufferIndex++;
        length = ((buffer[bufferIndex] & 0x01) << 16) + readInt2(buffer, bufferIndex + 1);

    void byteArrayConstructor_malformedDER_throwsWrapped() {
        // Arrange: Truncated SEQUENCE (0x30 len=2 but only 1 byte of content)
        byte[] malformed = new byte[] { 0x30, 0x02, 0x01 };

        // Act + Assert
        PACDecodingException ex = assertThrows(PACDecodingException.class, () -> new KerberosApRequest(malformed, null));

        }
        impersonationLevel = 0x02; // As seen on NT :~)
        securityFlags = (byte) 0x03; // SECURITY_CONTEXT_TRACKING | SECURITY_EFFECTIVE_ONLY
    }

    @Override
    int writeParameterWordsWireFormat(final byte[] dst, int dstIndex) {
        final int start = dstIndex;

        dst[dstIndex] = (byte) 0x00;
        dstIndex++;

            ASN1ObjectIdentifier[] mechs = new ASN1ObjectIdentifier[] { OID_KRB, OID_NTLM };
            int flags = NegTokenInit.DELEGATION | NegTokenInit.INTEGRITY;
            byte[] mechToken = new byte[] { 0x01, 0x02, 0x03, 0x04, 0x05 };
            byte[] mic = new byte[] { (byte) 0xAA, (byte) 0xBB, (byte) 0xCC };

            NegTokenInit original = new NegTokenInit(mechs, flags, mechToken, mic);

        return Stream.of(Arguments.of(new byte[] {}, ""), Arguments.of(new byte[] { (byte) 0x00 }, "00"),
                Arguments.of(new byte[] { (byte) 0x0F }, "0f"), Arguments.of(new byte[] { (byte) 0x10 }, "10"),
                Arguments.of(new byte[] { (byte) 0xAB }, "ab"),
                Arguments.of(new byte[] { (byte) 0x7F, (byte) 0x80, (byte) 0xFF }, "7f80ff"));
    }

 *
 * @author Alex Matevossian
 * @author David Beaumont
 * @since 15.0
 */
@GwtCompatible
public class XmlEscapers {
  private XmlEscapers() {}

  private static final char MIN_ASCII_CONTROL_CHAR = 0x00;
  private static final char MAX_ASCII_CONTROL_CHAR = 0x1F;

  // For each xxxEscaper() method, please add links to external reference pages
  // that are considered authoritative for the behavior of that escaper.

  /**

            /* 01234567
             * 00SSFSMB
             * 0 - 0's
             * S - size of payload
             * FSMB - 0xFF SMB magic #
             */

            if (sbuf[0] == (byte) 0x00 && sbuf[1] == (byte) 0x00 && sbuf[4] == (byte) 0xFF && sbuf[5] == (byte) 'S' && sbuf[6] == (byte) 'M'
                    && sbuf[7] == (byte) 'B') {
                break; /* all good */
            }
            /* out of phase maybe? */

        when(this.mechContext.getFlags()).thenReturn(0x1234);
        when(this.mechContext.initSecContext(any(byte[].class), eq(0), eq(0))).thenReturn(new byte[] { 0x01, 0x02 });

        // Act: len==0 triggers initial token construction
        byte[] out = ctx.initSecContext(null, 0, 0);

        // Assert: returns a SPNEGO token (opaque here but non-null/non-empty)