Some exotic Modbus slaves implement non-standard function codes or vendor-specific behaviours (for example, Read Coils returning a uint16 instead of a single bit); the vendor documentation must always be checked before assuming compliance with the standard.

Common vendor deviations include Read Coils that return a uint16 (some vendors encode a 0/1 coil on 16 bits), custom function codes 65-72 (Schneider and others add proprietary FCs inside the user-defined range reserved by the spec), and packed data layouts where a single 16-bit register carries several values. The only reliable cure is RTFM before integration, plus Wireshark or mbpoll on the live device to verify that the actual on-wire behaviour matches the document.

If a slave's behaviour seems to violate the spec, trust the wire capture over the datasheet; on Modbus the silicon is almost always more honest than the PDF.