Even without the DISCONNECT and syslogging you still leak quite a bit IFF the packet length decodes to something less than max packet. Yes, it's unlikely for an active attacker to cause that, since max packet will usually be on the order of 2^16 but the truly max packet length is on the order of 2^32, but surely you see the point.
It is not necessary to leak anything. If decoded packet length is invalid or exceeds MaxPacketLength (e.g. 2^16), then:
1. Select a random valid packet length between MinPacketLength and MaxPacketLength.
2. Read the randomly selected amount of data. 3. Choke as if MAC is incorrect.This prevents the attacker from knowing whether the info they're getting is useful or not, and the likelihood is 1 against 2^N that it's not.
denis