It was using REQUEST_SIZE_MATCH (client request length must equal request size) rather than REQUEST_AT_LEAST_SIZE (client request length must be at least big enough for request size), and this request has data following the request structure.