EJB3SubsystemXMLPersister checks the subsystem ModelNode for any of 3 child nodes and if present writes the start of a 'session-bean' element. Later it uses the same check and writes the closing tag.

But in between it check for other child nodes and does writing assuming the 'session-bean' element has been started. But it may not have been, which results in invalid xml.