Plug at cenc_encrypt_packet() or even better at gf_crypt_encrypt(). The latter option seems simpler: gf_crypt_encrypt(cstr->keys[0].crypt, output, pck_size - clear_trailing); can be replaced by queue_job();. We don't seem to use the data afterward (tests will tell ;) ).
Pre-allocate the output packet.
NB: bs_r is put in the context to avoir dynamic allocations only.
Don't forget to ask for a reference of the input packet (to avoid input data to be freed/recycled before complete use). Once complete send the output packet.