It actually was a problem rotating the reading buffer, the bigger the image size, the more probabilities to hit the bug. Eventually the buffer gets confused and reads more data than it needs, hence reading two totally different PDUs like if they were only one, failing the decryption ("Invalid MAC") or failing the PDU size ("Invalid token").

I found out while doing multimedia tests I sent a picture of 32700 bytes or so and Yappari said it reads 33400 bytes and I was like "WTF?"