RELAY_CONNECTED cells responding to RELAY_BEGIN_DIR cells don't have a payload
But there are only two RELAY_CONNECTED cell formats listed in the spec, and they both have payloads:
Otherwise, the exit node replies with a RELAY_CONNECTED cell, whose
payload is in one of the following formats:
The IPv4 address to which the connection was made [4 octets]
A number of seconds (TTL) for which the address may be cached [4 octets]
or
Four zero-valued octets [4 octets]
An address type (6) [1 octet]
The IPv6 address to which the connection was made [16 octets]
A number of seconds (TTL) for which the address may be cached [4 octets]
https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt#n1368
And the RELAY_BEGIN_DIR section could make this explicit, but doesn't:
If a Tor relay is a directory server, it should respond to a
RELAY_BEGIN_DIR cell as if it had received a BEGIN cell requesting a
connection to its directory port. RELAY_BEGIN_DIR cells ignore exit
policy, since the stream is local to the Tor process.
...
Clients MUST generate an all-zero payload for RELAY_BEGIN_DIR cells,
and relays MUST ignore the payload.
https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt#n1406
We could add:
Relays MUST also return an all-zero payload in RELAY_CONNECTED cells
sent in response to RELAY_BEGIN_DIR cells, and clients MUST ignore the
payload.