tests/NetworkSecurityConfigTest/res/xml/bad_config2.xml

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
  <domain-config>
    <domain>android.com</domain>
    <pin-set>
      <!-- empty digest -->
      <pin digest="SHA-256"></pin>
    </pin-set>
  </domain-config>
</network-security-config>