Still I wonder why  legacyBlockDecrypt() doesn't do the job here. Especially because it would return a clean result (without the trailing '\0')