Even better, don't give an answer right away, but say that you need 2-4 hours to investigate to be able to give an estimate, because that part of the codebase i

Even better, don't give an answer right away, but say that you need 2-4 hours to investigate to be able to give an estimate, because that part of the codebase is really knotty. That prepares a manager for bad news.