I'll use PKCS#1v2.2 (RSA Laboratories edition) as a reference.
Looking a the private key with an ASN.1 decoder, the public modulus $n$ is 512-bit, thus in RSASSA-PSS-VERIFY we have $modBits\,=\,512$, $k=64$.
Thus in EMSA-PSS-VERIFY we have $emBits\,=\,modBits\;-\,1\,=\,511$. $EM$ is the question's 64-octet string following $s^e\,\bmod n$. $emLen\,=\,\lceil\,emBits\,/\,8\,\rceil\,=\,64$. The hash is SHA-256, thus $hLen\,=\,32$. The question's salt is 30 octets, thus $sLen\,=\,30$. The constraint $emBits\,\ge\,8\,hLen\,+\,8\,sLen\,+\,9$ is met (with an extra $7$ bits).
At EMSA-PSS-VERIFY step 3, $emLen\,\ge\,hLen+\,sLen\,+\,2$, the check passes.
At step 4, the rightmost octet of $EM$ has hexadecimal value $\text{0xbc}$, the check passes.
At step 5, $maskedDB$ is the leftmost $emLen\;-\,hLen\;-\,1\,=\,31$ octets, as "mDB" in the question.
At step 6, it is considered the $8\,emLen\;-\,emBits\,=\,1$ leftmost bit(s) of the leftmost octet of $maskedDB$. That octet is $\text{0x64}$, that bit is $0$, the check passes.
At step 7, $dbMask$ is the 31 octets of the question's "mask".
At step 8, $DB$ is the 31 octets of the question's "DB".
At step 9, it is set the leftmost $8\,emLen\;-\,emBits\,=\,1$ bit(s) of the leftmost octet in $DB$ to zero. That leftmost octet goes from $\text{0x81}$ to $\text{0x01}$.
Why is the first byte of DB $\text{0x81}$ instead of $\text{0x01}$?
That first byte/leftmost octet is $\text{0x81}$ after step 8 because $dbMask$ is computed over an integer number of octets wide enough to perform the XOR of step 8, with $k\,+1\,\bmod\,8\,=\,1$ extra bit(s) if the left octet, which take pseudorandom value(s) in $dbMask$, thus in $DB$ after the XOR (which happens to be with zero bits, as checked at step 6). But these extra bit(s) in $DB$ get masked out to zero at step 9.
After that masking, the byte is $\text{0x01}$ because the signature is valid and the salt has been set to the maximum possible size $k\;-\,hLen\;-\,1$. It would be $\text{0x00}$ for any smaller salt size.
We can now answer the question in title:
May RSA-PSS $DB$ Most Significant Bit be 1?
No for $DB$ as computed
- during signature generation, in EMSA-PSS-ENCODE at step 8
- during signature verification, in EMSA-PSS-VERIFY at step 9, if $k\,\bmod8\,\ne\,1$ (because then step 9 masks this Most Significant Bit) or if the signature is valid (because then this Most Significant Bit must be zero, which will be checked at step 10);
but possibly so for $DB$ as computed during signature verification in EMSA-PSS-VERIFY
- at step 8 (irrespective of signature validity and value of $k$); this is what occurs in the question
- at step 9, though only for invalid signature and $k\,\bmod8\,=\,1$ (e.g. 2049-bit $n$). Notice that for such $k$, step 9 performs no masking, and step 10 will catch the signature as invalid if the Most Significant Bit of $DB$ happens to be 1.
