When decoding only a substring, we naturally see no padding, so we must
not base tail processing on the number of pad characters seen, but
rather on the number of characters missing until the end of the current
block of four.

Fixes #3378