What kind of pixels does badpixel.bin contain?
Dead (or rather by the canon firmware to zero) pixels.
I was under the impression, that it contained pixels where R=G=B=0 under all lighting conditions.
NO. The sensor has a bayer filter. Pixels on the sensor are
individual bayer elements.
One of R, G or B.
The Canon badixel list (and thus badpixel.bin) operates on individual sensor elements, since that's what goes bad.
When only one of these is zero, the resulting pixel in the de-bayered image contains the colors of the neighboring pixels, usually resulting in a yellow, cyan or magenta pixel (but sometimes you have several next to each other, which changes things. This seems common on newer cameras). This is exactly what we see in the image I linked.