bsonspec.org says "The int32 is the length in bytes of the entire code_w_s value" but in fact it's the length in bytes of the code portion of the value, including the code's null terminator byte.