This line made me go between it and inspecting the ssl3_record_st structure carefully, since the way it was written looked like a flexible array member:

    unsigned char *p = &s->s3->rrec.data[0], *pl;

I think it would be better written as:

    unsigned char *p = s->s3->rrec.data, *pl;

to make it clearer that data is a pointer within the structure.

Thanks; fascinating. The "length" of the payload is useful for error correcting, but the implementer didn't take advantage of this property, so it was usable against them. A double edged sword.