It looks like the information was never published.
There's definitely some non determinism WRT length of data to encrypted data:
: data length 1 encrypted length 38
: data length 2 encrypted length 38
: data length 3 encrypted length 41
: data length 4 encrypted length 42
: data length 5 encrypted length 43
: data length 6 encrypted length 42
: data length 7 encrypted length 43
: data length 8 encrypted length 43
: data length 9 encrypted length 47
: data length 10 encrypted length 47
: data length 11 encrypted length 46
: data length 12 encrypted length 50
: data length 13 encrypted length 51
: data length 14 encrypted length 45
: data length 15 encrypted length 53
: data length 16 encrypted length 52
So guessing where the nonce (iv and salt), data, and auth tag are is annoying. Without any docs from F5, I'm calling it quits, and will look at non-F5 solutions for my current need.