I've verified that calling:
ioctl(udp_socket, TIOCINQ, &v)
set v to 0 correctly if the queue is empty, but set v to a value 12
bytes lower than the correct one.
The bug is in the file net/ipv4/udp.c, function udp_ioctl, line 831
(Linux 2.1.89) and I suppose it was inserted in versione 2.1.73.