I'm seeing a similar thing, but with MIDI data coming from RTP-MIDI network connections inbound. Anything that generates a reasonably significant amount of traffic will do it, and it seems fairly random. It appears to be a recent problem, as I've run the exact same code in the same situations a thousand times before but since one of the latest updates I've been seeing this... possibly a bug in CoreMIDI?
I should note, the odd sizes I'm seeing are exactly 0x7000 in length...