According to the RFB protocol, section 6.6.4 (hextile encoding), regarding the 'ForegroundSpecified' bit, it says: 'If this bit is set then the SubrectsColoured bit must be zero.'. It doesn't seem QEMU's VNC server does that. In fact, it looks like both bits are set. I've verified against a different VNC server, and I didn't see this happening. (it may be a Wireshark dissector bug, of course).
TIA, Y.
