This is what GQ's documentation "GQ-RFC1701 GQ EMF Communication Protocol" says:
# 13. get serial number
# Command: <GETSERIAL>>
# Return: serial number in 7 bytes.
But this is only half-way correct. What the device actually returns is e.g.:
5C 28 34 36 39 37 14 00 48 36 37 31
These are 12 bytes. You see that the 8th byte is a zero, which in C computer language signals the end of a string, therefore the first 7 bytes make up the proper serial value. The final 4 values - in this example 4; this segment could be up to 8 characters long - is named DSID and is an additional identifier, which is sometimes (always?) needed for upgrading device firmware.
Overall, it is inappropriate handling of strings in C!
If you want to know more details run GeigerLog (https://sourceforge.net/projects/geigerlog/) and / or look into its code; it is Open Source.