Strictly speaking, you can put data in TCP FIN packet ... Quote from RFC 793 (emphasis mine):
SYN and FIN are the only controls requiring this protection, and these controls are only used when opening and closing a connection. For the sequence number of targets, a SYN is considered to be the octet of the segment in which it occurs before the first factual data , while FIN is considered to occur after the last actual data octet in the segment in which it occurs .
source share