SSL/TLS records consist of a 5 byte header plus the actual payload. SunJSSE currently reads that into a byte array starting at index 0, i.e. the payload - which needs to be crypted/MACed - starts at offset 5.

This might make certain optimizations impossible or degrade performance since some processors to not support word loads from unaligned addresses.