I read the Google paper about POODLE vulnerability (https://www.openssl.org/~bodo/ssl-poodle.pdf) and a lot of other articles.
Each paper/article wrote about that you have to try it in average 256 times to get the next byte in plaintext.
Currently my understanding is that I take a block of my encrypted data (located somewhere in the middle of all blocks) and copy it over the last block which contains the padding. I also understand that with some assumptions it is possible for a hacker to get the whole padding in this final block. And I understand how to calculate the last byte of the copied block if the MAC check succeeds.
However, I don't understand why the MAC check sometimes fails and sometimes not with the same copied encrypted block.
So I have following questions:
Why is the plaintext of the last block (this means for the last byte too) not always the same if I take the same encrypted block? Is this cause of the initial vector I need to get the plaintext?
Why the probability is exactly 1/256?