}
        return out;
    }

    @Test
    @DisplayName("getNTHash: known vector for 'password'")
    void testGetNTHash_knownVector() {
        // Arrange
        String password = "password";
        // Known NT hash for "password" (UTF-16LE MD4)
        // This is a well-known test vector: password -> 8846F7EAEE8FB117AD06BDD830B7586C

    @MethodSource("hexCases")
    @DisplayName("toString() renders lower-case hex with zero-padding")
    void toString_rendersHex(byte[] input, String expected) {
        // Arrange
        SecurityBlob blob = new SecurityBlob(input);

        // Act
        String actual = blob.toString();

        // Assert
        assertEquals(expected, actual, "Hex string should match expected format");

        // Arrange
        CIFSContext ctx = mock(CIFSContext.class);
        SmbTreeConnectionTrace trace = new SmbTreeConnectionTrace(ctx);

        // Act & Assert
        assertEquals(-1L, trace.getTreeId());
    }

    @Test
    @DisplayName("getConfig(): delegates to context")
    void getConfig_delegatesToContext() {
        // Arrange

    @BeforeEach
    void setUp() {
        MockitoAnnotations.openMocks(this);
    }

    @Test
    void constructor_shouldOpenAliasSuccessfully() throws IOException {
        // Arrange
        int access = 1;
        int rid = 100;

        // Mock the behavior of sendrecv for MsrpcSamrOpenAlias
        doAnswer(invocation -> {
            MsrpcSamrOpenAlias rpc = invocation.getArgument(0);

            // Arrange
            SamrPolicyHandle ph = createMockPolicyHandle();

            // Act & Assert
            assertDoesNotThrow(() -> new MsrpcSamrConnect2(null, 0, ph));
        }

        @Test
        @DisplayName("should accept negative access mask values")
        void testNegativeAccessMaskAccepted() {
            // Arrange

        verify(tree).connectLogon(null);
    }

    @Test
    @DisplayName("connectLogon propagates SmbException from implementation")
    void connectLogon_throws_propagates() throws Exception {
        // Arrange
        doThrow(new SmbException("login failed")).when(tree).connectLogon(context);

        // Act + Assert
        SmbException ex = assertThrows(SmbException.class, () -> tree.connectLogon(context));

        @MethodSource("invalidShareEnumCases")
        void doShareEnum_invalidPath_throws(String url, String pathSuffix, boolean expectDirSlashMsg) throws Exception {
            // Arrange
            SmbFile parent = new SmbFile(url);

            // Act + Assert
            SmbException ex = assertThrows(SmbException.class, () -> SmbEnumerationUtil.doShareEnum(parent, "*", 0, null, null));

    @BeforeEach
    void setUp() {
        // Setup is handled by MockitoExtension
    }

    @Test
    void constructor_shouldOpenPolicySuccessfully() throws IOException {
        // Arrange
        String server = "testServer";
        int access = 123;

        // Mock the behavior of sendrecv for MsrpcLsarOpenPolicy2
        doAnswer(invocation -> {

        return new DERSequence(v);
    }

    @Test
    @DisplayName("byte[] ctor: empty token throws PACDecodingException with clear message")
    void byteArrayConstructor_emptyToken_throws() {
        // Arrange
        byte[] empty = new byte[0];

        // Act + Assert
        PACDecodingException ex = assertThrows(PACDecodingException.class, () -> new KerberosApRequest(empty, new KerberosKey[0]));

    void setUp() {
        // MockitoAnnotations.openMocks(this); // Not needed with @ExtendWith(MockitoExtension.class)
    }

    @Test
    void constructor_shouldOpenPolicySuccessfully() throws IOException {
        // Arrange
        String server = "testServer";
        int access = 123;

        // Mock the behavior of sendrecv for MsrpcLsarOpenPolicy2
        doAnswer(invocation -> {