In the "..." part you presumably meant to include writes to members of s, and those writes are allowed to change padding bytes and leak information.