http://httpwg.org/specs/rfc7540.html#rfc.section.6.1 says:
The entire DATA frame payload is included in flow control, including the Pad Length and Padding fields if present.
We ignore the pad length and padding fields in our accounting.
I thought the fix was as easy as changing len(f.Data()) to f.Length in a few places, but then our accounting would be off when we return the flow control tokens on bytes read later. We'll probably want to just immediately return the flow control tokens for any padding immediately, in both the client and server.