PasswordMessage
The password itself, in the clear, in answer to an AuthenticationCleartextPassword request.
It shares the p tag with the SASL responses above because the tag says only "authentication material"; which of them the server is reading is decided by the request it sent. Nothing here protects the password - that is the connection's job, and the driver only sends this over one that is encrypted.