I wanted to get back to you and everyone here to finally say I solved this mystery.

This is to date one of the most difficult things I've ever done as a programmer. I have learned a ton, but would quite frankly rather code vehicle physics for games, not debug core http functionality in Perl CGI haha.

The darn jquery submit handler was nested incorrectly, and submitting the native form functionality and then the ajax submit form functionality. Somehow the two forms would work correctly upon submission, but I'm assuming form 1 would misconfigure the Apache header, so even though form 2 ran correctly, it was configured wrong upon return, thus sharting out a raw hash, even when I specified the headers.

What made it even harder was the fact that it did NOT double print any statements even though it would double submit. So there was no "2FA hit" followed by another "2FA hit" in my debug logs. The logic in Perl only ran once. Conceptually, I still don't know how to describe exactly what happened, nor do I know how CGI Perl managed to kind of both gracefully handle it, and not handle it at the same time.

I'm here to learn, so if anyone has any idea what behavior was happening between Apache and CGI Perl, I'd love a breakdown.