Interesting. After a little debugging with my test pcaps, it looks like,
when the issue arises, the sum of the individual timing components is
exactly 1 less than the total time. This might be a floating point
truncation issue, since pcap timestamps are floats and I convert them
to integer millisecond measurements before storing them. I'll look into it.
As a workaround, besides using pcapperf, you can disable the
"Validate data before processing" box on the HAR viewer.