<p>Actually, it&#39;s looking like the same bug.</p><p>I&#39;m seeing 18 bytes of padding being added in the MAC, but 20 on the wire. So those two bytes of trailing data should have been overwritten with the beginning of the FCS (I think).</p>