jstedfast/MailKit · error · ArgumentException

Invalid Type message.

Error message

Invalid Type{0} message.

What it means

ValidateArguments throws ArgumentException "Invalid Type{0} message." when CheckSignature fails: the buffer at startIndex does not start with the required 'NTLMSSP\0' signature. The library requires all NTLM messages to begin with this 8-byte magic marker before parsing. A buffer without it is not an NTLMSSP message at all.

Solutions

1. Ensure the byte array begins with the 'NTLMSSP\0' signature at startIndex
2. Unwrap any SASL/GSSAPI framing before passing the NTLM message
3. Dump the first 8 bytes at startIndex to confirm alignment

Example fix

// before
challenge.Decode(wrappedToken, 0, wrappedToken.Length); // SASL-framed
// after
var ntlm = UnwrapSasl(wrappedToken); // starts with NTLMSSP\0
challenge.Decode(ntlm, 0, ntlm.Length);

static bool HasNtlmSignature(byte[] buf, int start) =>
    buf != null && start + 8 <= buf.Length &&
    buf[start] == 'N' && buf[start+1] == 'T' && buf[start+2] == 'L' && buf[start+3] == 'M' &&
    buf[start+4] == 'S' && buf[start+5] == 'S' && buf[start+6] == 'P' && buf[start+7] == 0;

bool IsNtlmMessage(byte[] buf) => HasNtlmSignature(buf, 0);

try { msg.Decode(buffer, 0, buffer.Length); }
catch (ArgumentException ex) when (ex.Message.Contains("Invalid Type")) { /* not an NTLMSSP message — inspect peer data */ }

When it happens

Trigger: Calling a decode API with a byte[] whose first bytes at startIndex are not the ASCII signature 'NTLMSSP\0' (wrong protocol data, truncated message, or misaligned startIndex).

Common situations: Feeding a raw SASL/GSSAPI wrapped token instead of the unwrapped NTLM payload; startIndex pointing into the middle of the message past the signature; a peer sending a malformed or non-NTLM blob.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• inputBuffer
• inputOffset
• inputCount
• Can only transform 8 bytes at a time.
• outputBuffer

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/6918433c001ae06d. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Security/Ntlm/NtlmMessageBase.cs:90

					return false;
			}

			return BitConverterLE.ToUInt32 (message, startIndex + 8) == Type;
		}

		protected void ValidateArguments (byte[] message, int startIndex, int length)
		{
			if (message == null)
				throw new ArgumentNullException (nameof (message));

			if (startIndex < 0 || startIndex > message.Length)
				throw new ArgumentOutOfRangeException (nameof (startIndex));

			if (length < 12 || length > (message.Length - startIndex))
				throw new ArgumentOutOfRangeException (nameof (length));

			if (!CheckSignature (message, startIndex))
				throw new ArgumentException (string.Format (CultureInfo.InvariantCulture, "Invalid Type{0} message.", Type), nameof (message));

			var messageType = BitConverterLE.ToUInt32 (message, 8);
			if (messageType != Type)
				throw new ArgumentException (string.Format (CultureInfo.InvariantCulture, "Invalid Type{0} message.", Type), nameof (message));
		}

		public abstract byte[] Encode ();
	}
}

View on GitHub (pinned to 9d3859a785)