Flags (WebAuthn Level 3 §6.1): bit 0 UP (user present), bit 2 UV (user verified), bit 3 BE (backup eligible), bit 4 BS (backup state), bit 6 AT (attested credential data included), bit 7 ED (extensions included); bits 1 and 5 are reserved. Without AT and ED it is exactly 37 bytes. Attested credential data, present at registration, is a 16-byte AAGUID, a 2-byte credential ID length, the credential ID and the COSE public key.
The assertion signature covers authenticatorData ‖ SHA-256(clientDataJSON), so the relying party must verify the RP ID hash against its own RP ID, check UP (and UV if required) and evaluate the counter. Authenticators that do not implement a signature counter leave it at zero, which is the norm for synced passkeys; a counter that goes backwards on an authenticator that does use one can indicate a cloned key.