I was reading the code and had the same question and found the source for this. This is because, that after the status and length of the array gets sent, saned also sends if the pointer to the struct is null.
A pointer is encoded by a word that indicates whether the pointer is a NULL-pointer which is then followed by the value that the pointer points to (in the case of a non-NULL pointer; in the case of a NULL pointer, no bytes are encoded for the pointer value).
https://github.com/sjamesr/jfreesane/blob/d6531b419b8249d5e3258017758ca86f01875715/src/main/java/au/com/southsky/jfreesane/SaneInputStream.java#L83
I was reading the code and had the same question and found the source for this. This is because, that after the status and length of the array gets sent, saned also sends if the pointer to the struct is null.
The codeflow for this begins here https://gitlab.com/sane-project/backends/-/blob/master/sanei/sanei_net.c#L77 This function calls sanei_w_word to send the array length here https://gitlab.com/sane-project/backends/-/blob/master/sanei/sanei_wire.c#L193. After that for each element in the array, it calls sanei_w_device_ptr which we can see here https://gitlab.com/sane-project/backends/-/blob/master/sanei/sanei_wire.c#L237. And in this function, we can see here https://gitlab.com/sane-project/backends/-/blob/master/sanei/sanei_wire.c#L276, that saned also sents, if the pointer which they want to sent in null or not. So, that is why there comes also a null pointer.
I hope this helps. Btw good code clear to read.
In the docs, this is documented as follow