First tag byte, as two hexadecimal characters: Submit

Four-byte tag, as eight hexadecimal characters: Submit

Four-byte tag recovered from the noisy endpoint: Submit

What is the root cause?

HMAC-SHA256 produces tags that are too short.
The comparison stops at the first mismatching byte.
The authenticated message is known to the attacker.

Which repair addresses the root cause?

Add a larger random delay to every failure.
Encode both tags as hex and call String.equals.
Compare the byte arrays with MessageDigest.isEqual.

Review the repair