Sorry for the magic number. The -3 is to account for the 3 byte heartbeat header. OpenSSL complains if the total record length is > 16,384 unless the IE big buffer workaround is enabled.