According to this document the padded message has the following structure:
$EM \;= \; 0x00 \; || \; 0x02 \; || \; PS \; || \; 0x00 \; || \; M$
What is the purpose of this null byte at the beginning of the message?
After OS2IP decoding (also described in the document) to convert the message to a "bignum" I would expect this byte to be discarded, since a most significant byte of zero does not change the value of the number.
Also, when decoding the message, the standard document expects this zero byte to be present in the ouput too. Why should a bignum routine preserve a zero leading digit?
Instructions for decoding the message are given in the document and quoted below.
If the first octet of EM does not have hexadecimal value 0x00, if the second octet of EM does not have hexadecimal value 0x02, if there is no octet with hexadecimal value 0x00 to separate PS from M, or if the length of PS is less than 8 octets, output "decryption error" and stop.