I looked at recent .ts recordings:
1. Scrambling control in the PMT is 0x10, so DVB-CISSA here, not CSA3
2. Tuesday's H264 video had FF padding, easily spotted by the trailing 8-bytes of FF on the packets without an AF. And confirmed by the subsequent AF ending ...FF FF 80
3. Since CISSA's AES CBC encrypts the block left to right, the Crypt16 is the same irrespective of payload length.
4. Furthermore, the fact that the CBC crypt is done left to right (not right to left as per CSA) means only one round of AES required for building chains, not 23 rounds of CSA BC as per the B8hx Crypt8s
5. It's still hopeless...