http://w3.nue.suse.com/~bwiedemann/rb/boo1197780/ has sample binaries. diff of rpm --debug -qpvl < ufdio: 6 reads, 6809 total bytes in 0.000008 secs > ufdio: 6 reads, 6969 total bytes in 0.000008 secs shows that there are 60 extra bytes - probably in the header.