I'm afraid I didn't. I did find
http://isis.poly.edu/kulesh/stuff/src/klist/ which explains how to dereference the payload, by not why it's designed like that.
I'm
guessing that it is designed this way, so that when forward traversing a list, the next pointer is at the same address as the current list struct, thereby avoiding the burden of having to calculate next's address. But that doesn't sound terribly useful.