The record length says how many payload bytes follow the header.

highlighted = computed this step

Length points to the payload

The record length field says 4 payload bytes follow the header.

length=4\text{length}=4
Record lengthThe record header fields are decoded from the pinned TLS toy bytes.Record length40 bits / 5 bytes0x1603030004byte 0byte 1byte 2byte 300010110000000110000001100000000byte 400000100content-type22legacy-version0x0303record-length4(cont.)

The header itself is fixed here

The record header is 5 bytes. The length field does not count those header bytes.

header bytes=5\text{header bytes}=5
Record lengthThe record header fields are decoded from the pinned TLS toy bytes.Record length40 bits / 5 bytes0x1603030004byte 0byte 1byte 2byte 300010110000000110000001100000000byte 400000100content-type22legacy-version0x0303record-length4(cont.)

Total bytes combine both parts

This toy record has 5 header bytes plus 4 payload bytes.

5+4=95+4=9
Record lengthThe record header fields are decoded from the pinned TLS toy bytes.Record length40 bits / 5 bytes0x1603030004byte 0byte 1byte 2byte 300010110000000110000001100000000byte 400000100content-type22legacy-version0x0303record-length4(cont.)

Summary

The length field is the boundary marker between the header and the payload.

payload bytes=4\text{payload bytes}=4
Record lengthThe record header fields are decoded from the pinned TLS toy bytes.Record length40 bits / 5 bytes0x1603030004byte 0byte 1byte 2byte 300010110000000110000001100000000byte 400000100content-type22legacy-version0x0303record-length4(cont.)