"Am I missing something obvious?"

Yep :) A reference is a reference is a reference no matter how many times you re-assign it to something else, and always points to the same base item.

You need to "copy" the reference in order to break the link:

my $params = { %{ $self->{params} } };
[download]

What that does is it dereferences the incoming param into an anonymous hashref (the outer braces), and that new "copied" reference is then assigned to $params.