Proving the security of a one-way function with partially known input
You are right, it does not seem as if a reduction from OWF works here. Indeed it rather seems like a separation is possible. This is what @RickyDemer describes in his comment, i.e. showing that there exists at least one OWF $h$ for which the above use case is insecure. This would show that a reduction from OWF is impossible. 

You definitely can get a proof if you assume $h$ is a pseudorandom function family. In that case $TXT$ would have to be treated as key and the counter as message. Finding the (secret) key used for a PRF would allow to distinguish it from a truly random function with high probability and hence learning $TXT$ from the above inputs means breaking the PRF property of $h$... In practice you can for example use any HMAC as PRF.