use Linux kernel KCM for IPA header?
Since Linux kernel v4.10 in 2016 there is a feature called KCM, which allows to multiplex/demultiplex a TCP stream socket into datagram/seqpacket sockets inside the kernel. It's written exactly for such a use case. A BPF program then determines the message boundaries within the TCP stream. See https://mjmwired.net/kernel/Documentation/networking/kcm.rst
Using this mechanism we could avoid a lot of "three byte reads" on our IPA sockets and have this handled inside the kernel, with the kernel only passing full IPA messages to userspace.
Unfortunately it seems that at least Debian doesn't yet enable CONFIG_AF_KCM even after 6 years of having this feature in the kernel. It's not even experimental but yet nobody bothers enabling it. We'd have to get that changed and/or check the status in other distributions