I have read the RFC1928 several times and still couldn't understand what a compliant SOCKS 5 server is supposed to reply in case of failure. This doubt comes from the fact that the ATYP, BND.ADDR and BND.PORT fields from a SOCKS reply simply don't make sense if, for instance, a request with an invalid command is received. Must the server not send these fields or just send blanks?
In a failure reply, only the VER and REP fields are meaningful. The other fields may be present but are not used. You don't even need to look at those bytes unless REP is zero.