%D field in Apache access logs - first or last byte?

It's the last byte or rather, apr_time_now() - request_rec->request_time which is worked out during the logging phase. That phase happens last in the processing cycle, after the response has been sent.

Both values are useful to know for performance debugging. Time to first byte is the wait time or latency of the connection, while %D also includes the transfer time. The total time is what you use for overall performance and capacity planning, while the wait is what you try to minimize.

http://code.google.com/p/mod-log-firstbyte/ seems to imply that %D measures the time to last byte, whereas mod-log-firstbyte measures the time to first byte.