I think that pcap was for your random packet generator, given the two packets with exactly 411 bytes.
It would be helpful to see the packets with the Shadowsocks set up.
Whether it triggers is heavily dependent on the implementation, and I have no idea what your set up is doing.
Some implementations will send IV, connect request and application data as 3 separate packets. Some will merge the first two, and some, such as Outline, will merge the 3 of them.
I don’t think the IV+connect reaches 411 bytes, so it shouldn’t trigger the block. Is the pattern detected after the first packet?
It would be really nice to reproduce the blocking with Outline code. I wasn’t able to.