There is no problem to know the start position of "Encrypted payload data (without "Packet number")" in the long header type Quic packet, when "Packet number" takes only 1 byte.
You always know that "Encrypted payload data" goes after "Packet number" which length is 1 byte.
But if the "Packet number" takes more than 1 byte, how to know the offset between "Packet Length" and "Encrypted payload data"? The "Packet number field size" is "header protected" and to remove the header protection you need to know where "Encrypted payload" starts to use it part to remove "header protection". It turns out to be a vicious circle.
Can anybody explain this moment?