> encrypt the packet first using the packet number as a nonce, and then encrypt the packet number using some of the encrypted packet as a nonce (and a different key).

I may be missing any number of details, but I would expect a simpler scheme to work well: encrypt the packet number in ECB mode using a separate derived key.