}

    @Test
    @DisplayName("byte[] ctor: top-level non-SEQUENCE triggers PACDecodingException (type mismatch)")
    void byteArrayConstructor_topLevelNotSequence_throws() throws Exception {
        // Arrange: Encoded INTEGER instead of SEQUENCE
        byte[] notASequence = new ASN1Integer(42).getEncoded();

        // Act + Assert
        assertThrows(PACDecodingException.class, () -> new KerberosApRequest(notASequence, null));
    }

        byte[] dst = new byte[256];
        int bytesWritten = packet.writeTrailerWireFormat(dst, 0);

        assertTrue(bytesWritten > 0);
        // Each name should write at least 34 bytes (encoded name + scope)
        assertTrue(bytesWritten >= 68);
    }

    @Test
    @DisplayName("writeTrailerWireFormat with scope should handle scoped names")
    void testWriteTrailerWireFormatWithScope() {

TensorFlow
[**models**](https://developers.google.com/machine-learning/glossary/#model) (to
use a term commonly used by machine learning practitioners) are expressed as
programs that TensorFlow executes. TensorFlow programs are encoded as
computation
[**graphs**](https://developers.google.com/machine-learning/glossary/#graph).
Since models are practically programs that TensorFlow executes, using untrusted

   *
   * RFC 5280, section 4.1.2.5:
   *
   * > CAs conforming to this profile MUST always encode certificate validity dates through the year
   * > 2049 as UTCTime; certificate validity dates in 2050 or later MUST be encoded as
   * > GeneralizedTime.
   */
  internal val time: DerAdapter<Long> =
    object : DerAdapter<Long> {

            if (path != null && !path.isEmpty()) {
                final String pathWithoutLeadingSlash = path.startsWith("/") ? path.substring(1) : path;
                // Decode URL-encoded characters (e.g., %20 -> space)
                objectName = URLDecoder.decode(pathWithoutLeadingSlash, StandardCharsets.UTF_8);
            } else {
                objectName = StringUtil.EMPTY;
            }
        }

    ) {
      if (random != null) {
        val sslSocket = connection.socket() as SSLSocket
        val session = sslSocket.session

        val masterSecretHex =
          session.masterSecret
            ?.encoded
            ?.toByteString()
            ?.hex()

        if (masterSecretHex != null) {
          val keyLog = "CLIENT_RANDOM $random $masterSecretHex"

          if (verbose) {

	VADDPD X0, X1, K0, X2           // ERROR "invalid instruction"
	VADDPD Y0, Y1, K0, Y2           // ERROR "invalid instruction"
	VADDPD Z0, Z1, K0, Z2           // ERROR "invalid instruction"
	// VEX-encoded VSIB can't use High-16 registers as index (unlike EVEX).
	// TODO(quasilyte): improve error message (#21860).
	VPGATHERQQ X2, (BP)(X20*2), X3  // ERROR "invalid instruction"

      return "[" + toAddrString(ip) + "]";
    }
    return toAddrString(ip);
  }

  /**
   * Returns an InetAddress representing the literal IPv4 or IPv6 host portion of a URL, encoded in
   * the format specified by RFC 3986 section 3.2.2.
   *
   * <p>This method is similar to {@link InetAddresses#forString(String)}, however, it requires that
   * IPv6 addresses are surrounded by square brackets.

		}
		if b == ';' { // separating character
			break
		}

		// Manually deserialize the size since AWS specified
		// the chunk size to be of variable width. In particular,
		// a size of 16 is encoded as `10` while a size of 64 KB
		// is `10000`.
		switch {
		case b >= '0' && b <= '9':
			size = size<<4 | int(b-'0')
		case b >= 'a' && b <= 'f':
			size = size<<4 | int(b-('a'-10))

 *
 * b0
 * --
 *
 * The inclusive start of the range. We get the first 14 bits of this code point from the section
 * and the last 7 bits from this byte.
 *
 * The end of the range is not encoded, but can be inferred by looking at the start of the range
 * that follows.
 *
 * b1
 * --
 *
 * This is either a mapping decision or the length of the mapped output, according to this table:
 *
 * ```