It's probably worth implementing similar padding oracle countermeasures to OpenSSH. When OpenSSH detects a MAC failure, invalid packet length or invalid padding length for a CBC cipher, it keeps reading for an entire maximally-sized packet (less whatever has been read for the packet already). This deprives an attacker of feedback for guesses against the packet length given by the connection dropping.