Exactly, this fails to understand a fairly fundamental aspect of the attack: you can read past the end of the buffer. Looking at the OpenSSL code, it appears the size of the buffer you're reading from is 16KiB+a few hundred bytes. (I could be wrong - not 100% sure I've followed the code correctly - but it's not going to be larger than that for various reasons.) You can read up to 64KiB-1 bytes from it.