DROWN - decrypting ServerVerify message is not enough?
No, it's not a mistake. After Bleichenbacher's attack was discovered, the fix throughout SSL/TLS was to prevent the "padding oracle" by decrypting and following this strategy: if the PKCS#1v1.5 padding is correct, then use the PMS obtained; if the PKCS#1v1.5 padding is incorrect, then use a random PMS. This prevents the oracle since an attacker who doesn't know the PMS cannot distinguish these two events (they are also supposed to take the same amount of time). However, in SSLv2, since it takes only $2^{40}$ to brute force the server reply, it's possible to re-establish the oracle. Specifically, the attacker gives the ciphertext twice to the server. If the padding is correct, then the server will reply with the same key both times. If the padding is incorrect, then since the server chooses a random key in this case, it will reply with different keys. This enables the attacker to know if the padding in the RSA encryption was correct or not.