Would there be a timing difference between the malformed payload and signature verification? (I'm assuming both of these branches are novel to the injected code.)