KeePassXC can't communicate with YubiKey (wrong serial)

[kentala]

Overview

I have a new YubiKey 5C Nano (firmware 5.4.3). I have copied my keepass-database HMAC challenge to the new YubiKey. When I plug the YubiKey and try to login to my database, KeePassXC reports the wrong serial number for the hardware key and cannot interface with the hardware key.

Steps to Reproduce

1. With YubiKey connected enter database password and attempt to unlock.
2. The YubiKey is detected on the password unlock screen, but displays a wrong serial number.
3. Receive error: "Error while reading the database: Unable to calculate database key: Could not find interface for hardware key with serial number [WRONG SERIAL NUMBER]"
4. Additionally: clicking the Refresh Hardware Keys changes the reported hardware key serial number.

Expected Behavior

Login without difficulty.

Actual Behavior

Wrong YubiKey serial number, database remains locked.

Context

The new YubiKey is attached directly to the Macbook Air. KeePassXC does not run under a virtual machine. Installed from Homebrew. Several other YubiKeys work correctly on the same computer. The affected YubiKey works correctly on the same computer with other applications (PGP) and also with KeePass-databases on an Android phone with Keepass2Android v. 1.10-pre. The affected YubiKey is the only one connected to the Mac at the time of testing.

KeePassXC - Version 2.7.7
Revision: 68e2dd8

Qt 5.15.11
Debugging mode is disabled.

Operating system: macOS 13.6
CPU architecture: x86_64
Kernel: darwin 22.6.0

Enabled extensions:

• Auto-Type
• Browser Integration
• Passkeys
• SSH Agent
• KeeShare
• YubiKey
• Quick Unlock

Cryptographic libraries:

• Botan 3.1.1

NOTE:
Operating System: macOS

[droidmonkey]

I've had this happen before in testing, but it was easily cleared by refreshing the key list. There is definitely a bug, need to hunt it down.

[kentala]

I've had this happen before in testing, but it was easily cleared by refreshing the key list. There is definitely a bug, need to hunt it down.

If it's any help: most of the time the length of the wrong serial is correct, but sometimes the serial is reported as just the single number "4".

[mpas97]

I just went a bit through #10092. I found a mistake (we should pass productId not vendorId), not sure if related but worth to mention.

keepassxc/src/gui/osutils/macutils/DeviceListenerMac.cpp

Lines 56 to 57 in 1896883

	if (productId > 0) {
	auto pid = CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt32Type, &vendorId);

[droidmonkey]

Good catch! @phoerious