Ask HN: Heartbleed, what is behind the 64KB figure?

The Heartbleed disclosure says that up to 64KB can be returned by a vulnerable server (or client).

But the RFC states that the payload length can't be greater than 2^14 bytes (16KB).

The few PoC clients I've seen floating around are requesting 16KB of data from the server.

Even if you modify the message to request 64KB (technically, 65,535 bytes), you will still only get back 16KB of data.

What am I missing?