See this regression in kernel 3.19 and above: https://bugzilla.kernel.org/show_bug.cgi?id=96381 The problem is the tun/tap API is incorrectly returning 0 bytes instead of EAGAIN when nothing is available to read. To work around this, let's insert increasingly long pauses if the error is EOF.
If we only decrypted enough to read the full CommData1 header, then we wouldn't have to decrypt the entire buffer. We'd have the destination to which the encrypted packet needs to be sent. But at the moment we either decrypt just the common header or the entire packet.