Security consequences of HMAC(m, K) instead of the correct way HMAC(K, m) I am wondering what is the security loss or consequences of accidentally misusing an HMAC API library in this context:

Regular, correct HMAC:

HMAC(K, m) = H((K' ⊕ opad) || H((K' ⊕ ipad) || m))


Misused HMAC (the inputs to HMAC were accidentally swapped):

HMAC(m, K) = H((m ⊕ opad) || H((m ⊕ ipad) || K))


In this context the 'm' is actually some encrypted random data (used in the standard "Encrypt then MAC" scheme) and could be considered public from an attacker's perspective. The key is 256 bits. The HMAC is HMAC-SHA-256. 

Does this swapping of the inputs to HMAC mean that there is now a complete break or complete loss in security or the MAC? Is there now a length extension attack applicable? Or is it not so easily exploitable, seeing that the data is still hashed together by the outer hash?
$\DeclareMathOperator{\HMAC}{HMAC}\newcommand{\ipad}{\mathrm{ipad}}\newcommand{\opad}{\mathrm{opad}}\newcommand{\xor}{\oplus}\newcommand{\concat}{\mathop{\Vert}}$Yes.  It becomes vulnerable to collisions in $H$, if $m$ is longer than the block size of $H$, because in that case $\HMAC_m(k)$ is not actually $$H\bigl((\opad\xor m)\concat H((\ipad\xor m)\concat k)\bigr).$$  Rather, it is $$H\bigl((\opad\xor H(m))\concat H((\ipad\xor H(m))\concat k)\bigr).$$  (See RFC 2104, §2 ‘Definition of HMAC’, p. 3.)

What about single-block messages?  Well, it's unlikely that an attacker could find a structured pair of collisions $(\ipad\xor m_0, \ipad\xor m_1)$ and $(\opad\xor m_0, \opad\xor m_1)$ in $H$ for $m_0 \ne m_1$, but if they could, and if $H$ is Merkle–Damgård as is assumed in the usual HMAC security reductions (and if it's in the BLAKE2 or SHA-3 family, why bother with HMAC?), then $(m_0, m_1)$ would collide under $m \mapsto \HMAC_m(k)$ for any key $k$, enabling an attacker to immediately distinguish it from a random function or to forge messages authenticated under it.