account for pad bytes in DATA section lest decrypt fails