GitLab

But there are only two RELAY_CONNECTED cell formats listed in the spec, and they both have payloads:

   Otherwise, the exit node replies with a RELAY_CONNECTED cell, whose
   payload is in one of the following formats:
       The IPv4 address to which the connection was made [4 octets]
       A number of seconds (TTL) for which the address may be cached [4 octets]
    or
       Four zero-valued octets [4 octets]
       An address type (6)     [1 octet]
       The IPv6 address to which the connection was made [16 octets]
       A number of seconds (TTL) for which the address may be cached [4 octets]

https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt#n1368

And the RELAY_BEGIN_DIR section could make this explicit, but doesn't:

   If a Tor relay is a directory server, it should respond to a
   RELAY_BEGIN_DIR cell as if it had received a BEGIN cell requesting a
   connection to its directory port.  RELAY_BEGIN_DIR cells ignore exit
   policy, since the stream is local to the Tor process.

   ...

   Clients MUST generate an all-zero payload for RELAY_BEGIN_DIR cells,
   and relays MUST ignore the payload.

https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt#n1406

We could add:

   Relays MUST also return an all-zero payload in RELAY_CONNECTED cells
   sent in response to RELAY_BEGIN_DIR cells, and clients MUST ignore the
   payload.