I see a funny thing when I test it against yahoo.com:

  $ ./Heartbleed yahoo.com:443
  (bunch of returned bytes)
  2014/04/08 12:59:46 yahoo.com:443 - VULNERABLE

Near the front of the returned bytes is the sequence "yheartbleed.filippo.ioYELLOW SUBMARINE". That is some padding buried inside the Heartbleed source code.

I assume that the returned bytes are a peek inside the memory of a yahoo.com server, and we can see the padding supplied by Heartbleed, followed by some more bytes that depend on the server state.

Am I interpreting that correctly?