My torrent client DHT implementation frequently receives KRPC dict messages with 4 extra bytes before the message dictionary. Here is an example:
d1\xba\x04
Following that, is a bencoded dict, d
, the contents, and then e
, per the specification.
It appears the dictionary following the 4 bytes seems to always contain a y
of q
, so they're presumably queries.