With the CVE-2021-23839 change, there is at least 1 test suite that starts to fail where it does an encrypt using that padding mode, and then decrypts using the same padding mode. I think that's because of a misunderstanding of how the padding mode is supposed to work, and the error is really what should have happened.

My understanding of it that if you're talking SSLv2, but SSLv3 is supported, you should set that mode. This has as effect that if both sides of a connection use that padding mode, and so support SSLv3, but are talking SSLv2 the connection should fail. If the other doesn't support SSLv3, it would have used the RSA_PKCS1_PADDING padding mode and would not get an error.