Yes, I suppose that's a unique implementation risk for CTR and in that case Kragen's concerns about XOR are valid as well since you've got a stream cipher with

Yes, I suppose that's a unique implementation risk for CTR and in that case Kragen's concerns about XOR are valid as well since you've got a stream cipher with a short period. I was more thinking about how the cipher input has a predictable structure, in particular every pair of adjacent blocks differ by only a single fixed bit. This isn't an issue unless the underlying block cipher is badly broken, but it still feels unnecessarily risky.