The cryptographic answer is: yep, that sounds about right (with low confidence because the model violation is subtle).

The cryptographic engineering answer is: use OCB3 instead which doesn't have this problem :)