final int start = dstIndex;

        writeInt2(flags, dst, dstIndex);
        dstIndex += 2;
        writeInt2(desiredAccess, dst, dstIndex);
        dstIndex += 2;
        writeInt2(searchAttributes, dst, dstIndex);
        dstIndex += 2;
        writeInt2(fileAttributes, dst, dstIndex);
        dstIndex += 2;
        creationTime = 0;
        writeInt4(creationTime, dst, dstIndex);
        dstIndex += 4;

            byte[] buffer = new byte[60];
            SMBUtil.writeInt2(60, buffer, 0);
            SMBUtil.writeInt2(0xFFFF, buffer, 2); // Max flags
            SMBUtil.writeInt4(0xFFFFFFFF, buffer, 4); // Max reserved (ignored)
            SMBUtil.writeInt8(Long.MAX_VALUE, buffer, 8); // Max times
            SMBUtil.writeInt8(Long.MAX_VALUE, buffer, 16);
            SMBUtil.writeInt8(Long.MAX_VALUE, buffer, 24);

        SMBUtil.writeInt2(16, buffer, offset); // Structure size
        buffer[offset + 2] = (byte) 0x01; // Share type (DISK)
        buffer[offset + 3] = 0; // Reserved
        SMBUtil.writeInt4(0x8001, buffer, offset + 4); // Share flags (DFS | ENCRYPT_DATA)
        SMBUtil.writeInt4(0x28, buffer, offset + 8); // Capabilities (DFS | SCALEOUT)
        SMBUtil.writeInt4(0x1F01FF, buffer, offset + 12); // Maximal access

        SMBUtil.writeInt2(0x0311, buffer, 4);
        SMBUtil.writeInt2(1, buffer, 6);
        SMBUtil.writeInt4(128, buffer, 60); // Context offset

        // At offset 128 + 64 (header start), set context with excessive data length
        int contextPos = 192;
        SMBUtil.writeInt2(1, buffer, contextPos); // Context type

        int ci = 0;
        SMBUtil.writeInt4(0, ctx, ci); // Next = 0
        ci += 4;
        SMBUtil.writeInt2(0x10, ctx, ci); // NameOffset
        SMBUtil.writeInt2(4, ctx, ci + 2); // NameLength
        ci += 4;
        SMBUtil.writeInt2(0, ctx, ci); // Reserved
        SMBUtil.writeInt2(0x20, ctx, ci + 2); // DataOffset
        ci += 4;
        SMBUtil.writeInt4(8, ctx, ci); // DataLength
        ci += 4;

        SMBUtil.writeInt4(this.originalMessageSize, dst, dstIndex);
        dstIndex += 4;

        // Reserved (2 bytes)
        SMBUtil.writeInt2(0, dst, dstIndex);
        dstIndex += 2;

        // Flags (2 bytes)
        SMBUtil.writeInt2(this.flags, dst, dstIndex);
        dstIndex += 2;

        // Session ID (8 bytes)
        SMBUtil.writeInt8(this.sessionId, dst, dstIndex);

        int idx = 0;
        SMBUtil.writeInt2(transformCount, data, idx);
        idx += 2;
        SMBUtil.writeInt2(reserved1, data, idx);
        idx += 2;
        SMBUtil.writeInt4(reserved2, data, idx);
        idx += 4;

        // SMB_DIRECT_RDMA_TRANSFORM array (only one element)
        SMBUtil.writeInt2(rdmaTransformId, data, idx);
        idx += 2;
        SMBUtil.writeInt2(0, data, idx); // Reserved
        idx += 2;

        byte[] buffer = new byte[10];
        // sid = 1
        writeInt2(1, buffer, 0);
        // numEntries = 2
        writeInt2(2, buffer, 2);
        // isEndOfSearch = true
        buffer[4] = 0x01;
        buffer[5] = 0x00;
        // eaErrorOffset = 3
        writeInt2(3, buffer, 6);
        // lastNameOffset = 4
        writeInt2(4, buffer, 8);

        SMBUtil.writeInt2(this.fid, dst, dstIndex);
        dstIndex += 2;
        SMBUtil.writeInt4(this.offset, dst, dstIndex);
        dstIndex += 4;
        for (int i = 0; i < 4; i++) {
            dst[dstIndex++] = (byte) 0xFF;
        }
        SMBUtil.writeInt2(this.writeMode, dst, dstIndex);
        dstIndex += 2;
        SMBUtil.writeInt2(this.remaining, dst, dstIndex);
        dstIndex += 2;

        final int start = dstIndex;

        SMBUtil.writeInt2(this.tflags, dst, dstIndex);
        dstIndex += 2;
        SMBUtil.writeInt2(this.desiredAccess, dst, dstIndex);
        dstIndex += 2;
        SMBUtil.writeInt2(this.searchAttributes, dst, dstIndex);
        dstIndex += 2;
        SMBUtil.writeInt2(this.fileAttributes, dst, dstIndex);
        dstIndex += 2;
        this.creationTime = 0;