[BUG] Unlocking database with Password + Challenge-Response (YubiKey) master key type breaks the Database.xml file

Checks

• I have read the FAQ section, searched the open issues, and still think this is a new bug.

Describe the bug you encountered:

Whenever I unlock my database in Keepass2Android on my Google Pixel 8, the "Database.xml" file breaks. A second </data> is added to the file at the end immediately after unlocking and next time I want to unlock the database I'm unable to do that (Keepass2Android as well as the original KeePass desktop app return errors). I have to manually remove the last line with an XML editor to make my database usable again.

I'm using Password + Challenge-Response master key type for my database where Challenge-Response is provided by the YubiKey.

Describe what you expected to happen:

Expected to be able to unlock my database freely whenever I need to and the Database.xml file to be a valid readable XML file after unlocking the database using the Keepass2Android app.

What version of Keepass2Android are you using?

1.14-r4

Which version of Android are you on?

16

Start by reproducing the unlock flow in Keepass2Android 1.14-r4 on Android 16 with a Password + Challenge-Response YubiKey master key, then inspect how Database.xml is handled during unlock. Done means the file remains valid XML, has no duplicate closing data element, and the database can be reopened in both Keepass2Android and the desktop KeePass app.