throw new PACDecodingException("Malformed kerberos token");
            }

            ASN1TaggedObject mechToken = ASN1Util.as(ASN1TaggedObject.class, stream.readObject());
            if (mechToken == null || mechToken.getTagClass() != BERTags.APPLICATION
                    || !(mechToken.getBaseObject() instanceof ASN1Sequence)) {
                throw new PACDecodingException("Malformed kerberos token");
            }

            new KerberosRelevantAuthData(malformedToken, keys);
        }, "A PACDecodingException should be thrown for a malformed token.");

        assertEquals("Malformed kerberos ticket", exception.getMessage(), "The exception message should indicate a malformed ticket.");
    }

    /**
     * Test constructor with an empty token.

    }

    /**
     * Test constructor with KERB_CHECKSUM_HMAC_MD5 type.
     *
     * @throws IOException if an I/O error occurs
     * @throws PACDecodingException if the PAC is malformed
     */
    @Test
    void testConstructorKerbChecksumHmacMd5() throws IOException, PACDecodingException {
        // Prepare data
        ByteArrayOutputStream baos = new ByteArrayOutputStream();

            // Verify that the XML formatting is correct - no malformed closing tags
            assertFalse(result.contains("</plugin></plugins>"), "Should not have malformed closing tags");
            assertFalse(result.contains("</plugins></pluginManagement>"), "Should not have malformed closing tags");

            // Check that proper indentation is maintained

                throw new IOException("Malformed SPNEGO token " + constructed);
            }

            final ASN1Sequence vec = (ASN1Sequence) constructed.getBaseObject();

            final ASN1ObjectIdentifier spnego = (ASN1ObjectIdentifier) vec.getObjectAt(0);
            if (!SPNEGO_OID.equals(spnego)) {
                throw new IOException("Malformed SPNEGO token, OID " + spnego);
            }

    }

    @Test
    @DisplayName("byte[] ctor: malformed DER is wrapped as PACDecodingException (IOException path)")
    void byteArrayConstructor_malformedDER_throwsWrapped() {
        // Arrange: Truncated SEQUENCE (0x30 len=2 but only 1 byte of content)
        byte[] malformed = new byte[] { 0x30, 0x02, 0x01 };

        // Act + Assert

	D   string `json:"d,omitempty"`
	N   string `json:"n,omitempty"`
	E   string `json:"e,omitempty"`
	K   string `json:"k,omitempty"`
}

var (
	errMalformedJWKRSAKey = errors.New("malformed JWK RSA key")
	errMalformedJWKECKey  = errors.New("malformed JWK EC key")
)

// DecodePublicKey - decodes JSON Web Key (JWK) as public key
func (key *JWKS) DecodePublicKey() (crypto.PublicKey, error) {
	switch key.Kty {
	case "RSA":

     * @throws PACDecodingException if the string structure is malformed
     */
    public PacUnicodeString readUnicodeString() throws IOException, PACDecodingException {
        final short length = readShort();
        final short maxLength = readShort();
        final int pointer = readInt();

        if (maxLength < length) {
            throw new PACDecodingException("Malformed string in PAC");
        }

            return false
          } // Malformed.
        }
      }
      pos++ // Consume '-'.
    }

    var n = INITIAL_N
    var i = 0
    var bias = INITIAL_BIAS

    while (pos < limit) {
      val oldi = i
      var w = 1
      for (k in BASE until Int.MAX_VALUE step BASE) {
        if (pos == limit) return false // Malformed.
        val c = string[pos++]
        val digit =

     * @param data the raw PAC data bytes
     * @param keys map of Kerberos keys for signature validation
     * @throws PACDecodingException if the PAC data is malformed or signature validation fails
     */
    public Pac(byte[] data, Map<Integer, KerberosKey> keys) throws PACDecodingException {
        byte[] checksumData = data.clone();
        try {